Swift Website Updates & Maintenance https://swiftupdates.ca Swift Website Updates | Wordpress Support Thu, 23 Jul 2026 21:45:52 +0000 en-US hourly 1 https://wordpress.org/?v=7.0.2 https://swiftupdates.ca/wp-content/uploads/2022/11/Screen-Shot-2022-11-10-at-1.41.01-PM.png Swift Website Updates & Maintenance https://swiftupdates.ca 32 32 Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-july-13-2026-to-july-19-2026/ Thu, 23 Jul 2026 21:45:52 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-july-13-2026-to-july-19-2026/ Last week, there were 75 vulnerabilities disclosed in WordPress Core, 68 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 50 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 71
Unpatched 4

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 48
High Severity 21
Critical Severity 6

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 25
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 14
Missing Authorization 13
Exposure of Sensitive Information to an Unauthorized Actor 4
Improper Privilege Management 4
Authorization Bypass Through User-Controlled Key 3
Cross-Site Request Forgery (CSRF) 3
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 3
Always-Incorrect Control Flow Implementation 1
Deserialization of Untrusted Data 1
Improper Input Validation 1
Improper Verification of Cryptographic Signature 1
Incorrect Privilege Assignment 1
Unrestricted Upload of File with Dangerous Type 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

25

3

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Academy LMS academy
Advance Product Search- Voice & Ajax Search for WooCommerce th-advance-product-search
Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit aimogen-pro
Autopay dla WooCommerce pay-wp
Avada (Fusion) Builder fusion-builder
Booking for Appointments and Events Calendar – Amelia ameliabooking
Breakdance breakdance
Bricksforge bricksforge
Catch Themes Demo Import catch-themes-demo-import
ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form chat-help
Digits: WordPress Mobile Number Signup and Login digits
Download Monitor – WPForms Lock dlm-wpforms-lock
Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ easy-accordion-free
Easy Appointments easy-appointments
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce erp
Fense Proxy & VPN Blocker fense-block-vpn-proxy
FoodBook Lite – Online Food Ordering System foodbook-light-online-food-ordering-system
Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database form-vibes
GiveWP – Donation Plugin and Fundraising Platform give
Gravity Forms gravityforms
HubSpot All-In-One Marketing – Forms, Popups, Live Chat leadin
Kali Forms — Contact Form & Drag-and-Drop Builder kali-forms
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages page-builder-add
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
List category posts list-category-posts
Loco Translate loco-translate
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor
MxChat – AI Chatbot & Content Generation for WordPress mxchat-basic
News Kit Addons For Elementor news-kit-elementor-addons
Ninja Forms – Excel Export ninja-forms-excel-export
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist woocommerce-product-stock-alert
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar
pCloud WP Backup pcloud-wp-backup
Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress
Premium Packages – Sell Digital Products Securely wpdm-premium-packages
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces best-woocommerce-feed
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker quiz-master-next
RPB Chessboard rpb-chessboard
SAML Single Sign On – SSO Login miniorange-saml-20-single-sign-on
SEO Booster seo-booster
Smart Custom Fields smart-custom-fields
Smart Slider 3 smart-slider-3
Sprout Clients – CRM and Lead Management sprout-clients
SysBasics Customize My Account for WooCommerce – Live My Account Customizer customize-my-account-for-woocommerce
The Cache Purger the-cache-purger
Themify Builder themify-builder
Tickera – Sell Tickets & Manage Events tickera-event-ticketing-system
TrueBooker – Appointment Booking and Scheduler System truebooker-appointment-booking
Tutor LMS – eLearning and online course solution tutor
Ultimate Auction Pro ultimate-woocommerce-auction-pro
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin uncanny-automator
W3SC Elementor to Zoho CRM w3sc-elementor-to-zoho
WooCommerce Placetopay Gateway https://github.com/placetopay/woocommerce-gateway-placetopay
WooCommerce Placetopay Gateway Belice woocommerce-gateway-placetopay-belice
WooCommerce Placetopay Gateway Colombia woocommerce-gateway-placetopay-colombia
WooCommerce Placetopay Gateway Ecuador woocommerce-gateway-placetopay-ecuador
WooCommerce Placetopay Gateway Honduras woocommerce-gateway-placetopay-honduras
WooCommerce Placetopay Gateway Uruguay woocommerce-gateway-placetopay-uruguay
WP Bulk Delete wp-bulk-delete
WP Customer Area customer-area
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) delicious-recipes
WP Hotel Booking wp-hotel-booking
WP TripAdvisor Review Slider wp-tripadvisor-review-slider
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services chatbot
wpForo Forum wpforo
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell wpfunnels

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 – Unauthenticated Privilege Escalation via ‘aiomatic_call_google_ai_function’

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-15982
Patch Status

Patched
Published
Jul 13, 2026

Affected Software

Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit [aimogen-pro]

Researcher

More Details >

Bricksforge <= 3.1.8.6 – Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14956
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Bricksforge [bricksforge]

Researcher

More Details >

Podlove Podcast Publisher <= 4.5.1 – Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-13001
Patch Status

Patched
Published
Jul 14, 2026

Affected Software

Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]

Researcher

More Details >

SAML Single Sign On <= 5.4.3 – Unauthenticated Authentication Bypass via ‘SAMLResponse’ Parameter Signature Algorithm Confusion

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-15013
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]

Researcher

More Details >

TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-61951
Patch Status

Patched
Published
Jul 17, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

More Details >

WordPress Core 6.9 – 7.0.1 – Remote Code Execution via REST API Batch Request Route Confusion

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-63030
Patch Status

Patched
Published
Jul 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 – Authenticated (Subscriber+) Privilege Escalation via ‘digits_reg_userrole’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-13741
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Digits: WordPress Mobile Number Signup and Login [digits]

Researcher

More Details >

Loco Translate <= 2.8.5 – Cross-Site Request Forgery to Remote Code Execution via ‘template’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-15005
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Loco Translate [loco-translate]

Researcher

More Details >

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 – Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-13352
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar]

Researchers

More Details >

WPFunnels <= 3.12.8 – Authenticated (Funnel Manager+) Privilege Escalation via ‘group_id’ Path Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-15103
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

More Details >

Uncanny Automator <= 7.3.1.4 – Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-15008
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin [uncanny-automator]

Researcher

More Details >

Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 – Unauthenticated SQL Injection via ‘s’ and ‘match’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12753
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Advance Product Search- Voice & Ajax Search for WooCommerce [th-advance-product-search]

Researcher

More Details >

Gravity Forms <= 2.10.4 – Unauthenticated Arbitrary File Read via ‘gform_uploaded_files’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12997
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Gravity Forms [gravityforms]

Researcher

More Details >

LearnPress <= 4.4.1 – Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-13765
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

Online Scheduling and Appointment Booking System – Bookly <= 27.7 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-61949
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Premium Packages – Sell Digital Products Securely <= 6.2.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-61948
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

More Details >

TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-61950
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

More Details >

WordPress Core 6.8 – 7.0.1 – Unauthenticated SQL Injection via author__not_in Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-60137
Patch Status

Patched
Published
Jul 17, 2026

Affected Software

WordPress [wordpress]

Researchers

More Details >

Breakdance <= 2.7.1 – Unauthenticated Stored Cross-Site Scripting via Webhook Action Details

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-7543
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Breakdance [breakdance]

Researcher

More Details >

Download Monitor – WPForms Lock <= 1.0.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57427
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Download Monitor – WPForms Lock [dlm-wpforms-lock]

Researcher

More Details >

Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database <= 1.5.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-61947
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database [form-vibes]

Researcher

More Details >

Kali Forms <= 2.4.18 – Unauthenticated Stored Cross-Site Scripting via ‘digitalSignature’ Field Value

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-15395
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

More Details >

Online Scheduling and Appointment Booking System – Bookly <= 27.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-61944
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

RPB Chessboard <= 8.1.2 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13042
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

RPB Chessboard [rpb-chessboard]

Researcher

More Details >

Sprout Clients – CRM and Lead Management <= 3.2.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57428
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Sprout Clients – CRM and Lead Management [sprout-clients]

Researcher

More Details >

Ultimate Auction Pro <= 2.4.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-4110
Patch Status

Unpatched
Published
Jul 13, 2026

Affected Software

Ultimate Auction Pro [ultimate-woocommerce-auction-pro]

Researcher

More Details >

Ultimate Auction Pro <= 2.4.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-4259
Patch Status

Unpatched
Published
Jul 13, 2026

Affected Software

Ultimate Auction Pro [ultimate-woocommerce-auction-pro]

Researcher

More Details >

MultiVendorX <= 5.0.9 – Authenticated (Store Owner+) SQL Injection via ‘order_by’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12941
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

More Details >

pCloud WP Backup <= 2.0.3 – Missing Authorization on the ‘start_backup’ AJAX Method to Authenticated (Subscriber+) Arbitrary File Read

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-14503
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

pCloud WP Backup [pcloud-wp-backup]

Researcher

More Details >

Quiz and Survey Master (QSM) <= 11.2.0 – Authenticated (Custom+) SQL Injection via ‘pages’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13767
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

More Details >

Tickera <= 3.6.0.0 – Authenticated (Staff+) SQL Injection via ‘s’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13754
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

More Details >

Tutor LMS <= 4.0.0 – Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-15022
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Avada Builder <= 3.15.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12536
Patch Status

Patched
Published
Jul 13, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

ChatHelp <= 3.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘number’ and ‘group’ Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15759
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form [chat-help]

Researcher

More Details >

Easy Accordion <= 3.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘align’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15652
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ [easy-accordion-free]

Researcher

More Details >

GiveWP <= 4.16.3 – Authenticated (Give Worker+) Stored Cross-Site Scripting via ‘twitter_message’ Sequoia Template Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14987
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researchers

More Details >

News Kit Addons For Elementor <= 1.4.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11390
Patch Status

Patched
Published
Jul 13, 2026

Affected Software

News Kit Addons For Elementor [news-kit-elementor-addons]

Researcher

More Details >

Ninja Forms – Excel Export <= 3.3.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘filter’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15161
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Ninja Forms – Excel Export [ninja-forms-excel-export]

Researcher

More Details >

Smart Custom Fields <= 5.0.7 – Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2594
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Smart Custom Fields [smart-custom-fields]

Researcher

More Details >

Tickera <= 3.6.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘price_wrapper’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13755
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

More Details >

WP Customer Area <= 8.3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘type’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-7640
Patch Status

Patched
Published
Jul 13, 2026

Affected Software

WP Customer Area [customer-area]

Researcher

More Details >

WP Delicious <= 1.10.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘steps’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15099
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) [delicious-recipes]

Researcher

More Details >

wpForo Forum <= 3.1.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘location’ Profile Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15021
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

Product Feed Manager For WooCommerce <= 7.6.1 – Reflected Cross-Site Scripting via ‘s’ Search Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-15306
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces [best-woocommerce-feed]

Researcher

More Details >

WooCommerce Placetopay Gateway <= 3.2.2 – Reflected Cross-Site Scripting via ‘redirect-url’

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-11324
Patch Status

Unpatched
Published
Jul 16, 2026

Affected Software

WooCommerce Placetopay Gateway [https://github.com/placetopay/woocommerce-gateway-placetopay]
WooCommerce Placetopay Gateway Belice [woocommerce-gateway-placetopay-belice]
WooCommerce Placetopay Gateway Colombia [woocommerce-gateway-placetopay-colombia]
WooCommerce Placetopay Gateway Ecuador [woocommerce-gateway-placetopay-ecuador]
WooCommerce Placetopay Gateway Honduras [woocommerce-gateway-placetopay-honduras]
WooCommerce Placetopay Gateway Uruguay [woocommerce-gateway-placetopay-uruguay]

Researcher

More Details >

WP Hotel Booking <= 2.3.2 – Reflected Cross-Site Scripting via ‘check_in_date’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-15094
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

More Details >

Autopay dla WooCommerce <= 2.2.27 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57425
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Autopay dla WooCommerce [pay-wp]

Researcher

More Details >

Easy Appointments <= 3.12.27 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-61946
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Fense Proxy & VPN Blocker <= 3.0.1 – Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8616
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Fense Proxy & VPN Blocker [fense-block-vpn-proxy]

Researcher

More Details >

FoodBook Lite <= 1.5.6 – Missing Authorization to Unauthenticated User Registration via ‘registration_action’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11802
Patch Status

Patched
Published
Jul 13, 2026

Affected Software

FoodBook Lite – Online Food Ordering System [foodbook-light-online-food-ordering-system]

Researcher

More Details >

Premium Packages – Sell Digital Products Securely <= 6.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-61943
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

More Details >

WPBot <= 8.5.6 – Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via ‘userid’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-15106
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia <= 2.4.3 – Authenticated (Custom+) SQL Injection via Customer Import

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-14782
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Kirki <= 6.0.13 – Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via ‘family’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-15457
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

SEO Booster <= 7.3.1 – Authenticated (Administrator+) SQL Injection via ‘orderby’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-15445
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

SEO Booster [seo-booster]

Researcher

More Details >

SEO Booster <= 7.3.1 – Authenticated (Administrator+) SQL Injection via ‘sort_field’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-15458
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

SEO Booster [seo-booster]

Researcher

More Details >

WP Bulk Delete <= 1.4.2 – Authenticated (Administrator+) SQL Injection via ‘delete_user_roles’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-15727
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

WP Bulk Delete [wp-bulk-delete]

Researcher

More Details >

WP TripAdvisor Review Slider <= 14.6 – Authenticated (Administrator+) SQL Injection via ‘filtersource’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-15651
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

WP TripAdvisor Review Slider [wp-tripadvisor-review-slider]

Researcher

More Details >

MxChat <= 3.2.10 – Authenticated (Admin+) Stored Cross-Site Scripting via ‘intro_message’ Setting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-13005
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

MxChat – AI Chatbot & Content Generation for WordPress [mxchat-basic]

Researcher

More Details >

SysBasics Customize My Account for WooCommerce <= 4.4.14 – Authenticated (Shop Manager+) Stored Cross-Site Scripting via ‘row_type’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-15324
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

SysBasics Customize My Account for WooCommerce – Live My Account Customizer [customize-my-account-for-woocommerce]

Researcher

More Details >

Academy LMS <= 3.8.0 – Authenticated (Subscriber+) Insecure Direct Object Reference via ‘user_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9341
Patch Status

Patched
Published
Jul 13, 2026

Affected Software

Academy LMS [academy]

Researcher

More Details >

Catch Themes Demo Import <= 3.3 – Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via ‘activate_plugin’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15336
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Catch Themes Demo Import [catch-themes-demo-import]

Researcher

More Details >

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-59522
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]

Researcher(s): Unknown

More Details >

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15349
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]

Researcher

More Details >

HubSpot All-In-One Marketing <= 11.3.62 – Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9656
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

HubSpot All-In-One Marketing – Forms, Popups, Live Chat [leadin]

Researcher

More Details >

Landing Page Builder <= 1.5.3.6 – Cross-Site Request Forgery to ulpb_admin_data AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12409
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages [page-builder-add]

Researcher

More Details >

List category posts <= 0.95.0 – Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via ‘post_status’ Shortcode Attribute

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12434
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

List category posts [list-category-posts]

Researchers

More Details >

Ninja Forms – Excel Export <= 3.3.6 – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via ‘spreadsheet_export_form_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15159
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Ninja Forms – Excel Export [ninja-forms-excel-export]

Researcher

More Details >

Ninja Forms – Excel Export <= 3.3.6 – Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15160
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Ninja Forms – Excel Export [ninja-forms-excel-export]

Researcher

More Details >

Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist <= 3.0.6 – Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-61945
Patch Status

Patched
Published
Jul 16, 2026

Affected Software

Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist [woocommerce-product-stock-alert]

Researcher

More Details >

Smart Slider 3 <= 3.5.1.37 – Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via ‘keyword’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12385
Patch Status

Patched
Published
Jul 13, 2026

Affected Software

Smart Slider 3 [smart-slider-3]

Researcher

More Details >

The Cache Purger <= 2.3.20 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via ‘the_log_purge’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15350
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

The Cache Purger [the-cache-purger]

Researcher

More Details >

Themify Builder <= 7.7.7 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15407
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

Themify Builder [themify-builder]

Researcher

More Details >

W3SC Elementor to Zoho CRM <= 2.2.0 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9734
Patch Status

Unpatched
Published
Jul 17, 2026

Affected Software

W3SC Elementor to Zoho CRM [w3sc-elementor-to-zoho]

Researcher

More Details >

WPBot <= 8.5.6 – Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15610
Patch Status

Patched
Published
Jul 15, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026) appeared first on Wordfence.

]]> A New Threat Landscape Meets A New Kind of Defender https://swiftupdates.ca/a-new-threat-landscape-meets-a-new-kind-of-defender/ Thu, 23 Jul 2026 17:42:48 +0000 https://swiftupdates.ca/a-new-threat-landscape-meets-a-new-kind-of-defender/ Three years ago we launched a bug bounty program to accelerate WordPress security research, and it has been incredibly successful and has since secured the WordPress community against 9,727 vulnerabilities reported through our program. We have thus far awarded a total of $981,251 to researchers around the world to reward the increased security they provide the WordPress community.

A year ago we extrapolated the progress in AI vulnerability research that we were seeing and realized that it would soon overtake human capability. We realized that, rather than allow a threat actor to lead innovation in vulnerability research, we needed to be the leaders. We started work on an AI vulnerability research project called PRISM, which we launched three months ago.

PRISM has produced 88 published vulnerabilities in the past 30 days, or an average of 2.8 vulnerabilities per day, purely autonomously. Wordfence PRISM has become our number 1 researcher in the past 30 days. It’s likely you will see that number continue to climb after we publish this post. To date, PRISM has discovered 202 vulnerabilities with several getting discovered every day.

Due to the volume of vulnerabilities that our Bug Bounty Program produces, we created an AI assisted triage tool called Eclipse, which has also helped us effectively triage output from PRISM. Eclipse triages vulnerabilities submitted by our human researchers, and by PRISM. This has massively accelerated our vulnerability pipeline, allowing for faster confidential disclosure to vendors, and faster release of firewall rules to our customers.

A New Threat Landscape

Our preparations to face this new threat landscape have yielded timely results. In the past weeks we have seen a prompt used for a math breakthrough adapted for use in vulnerability research, and within 10 hours produce one of the worst vulnerabilities in the history of WordPress core, and the first WordPress Core RCE in a decade.

Our team was able to respond as quickly as we did because our vulnerability analysis pipeline is AI assisted. In fact our researchers have become agentic coders. As they use Eclipse for triage, they also submit pull-requests to improve the product itself, thereby accelerating our agentic triage pipeline even further. This kind of massive organizational acceleration is what is needed to respond to the new threat landscape that is emerging.

In the past few days we have also seen Hugging Face compromised by a cybersecurity agent that OpenAI was testing, which broke out of its sandbox and compromised their partner’s systems. Both Anthropic and OpenAI are foundational AI providers, but have, as a side effect of their work, emerged at the forefront of cybersecurity as their models outpace human capabilities.

While the temptation to regulate access to these models exists, in the past week we have seen Chinese models Kimi K3 and Qwen 3.8 both emerge at the forefront of the AI leaderboards, rivaling the best that OpenAI and Anthropic have to offer. The USA does not have the ability to regulate Chinese providers. Furthermore, Kimi K3’s weights will be released on July 27th, making it impossible to regulate because at that point, anyone can download and run or distribute the model. Alibaba have indicated that Qwen 3.8 weights will also be released.

It also turns out that harness engineering can produce spectacular research results from models with modest parameter counts at a modest cost. We’ve seen this in our own research, and have seen it replicated elsewhere. Which means that, even if it was possible for a government to regulate away access to powerful Chinese and American models, the open-weights models that have already been released will continue to make breakthroughs in cybersecurity and other realms.

The process used in the math breakthrough that led to discovering the recent WordPress RCE vulnerability is a significant WordPress security research breakthrough. It was as a result of prompt engineering. It wasn’t just a powerful new model that took it upon itself to make this breakthrough. A researcher recognized a new prompt methodology used in mathematics that produced impressive results, and repurposed that for cybersecurity, leading to the breakthrough. Thus we can say that prompt engineering has now been legitimized as a field for innovation, and that the return on that research investment is clear.

How We’re Responding

So with multiple countries competing to out-innovate each other, open weights models being released at a rapid pace, the impossibility of AI regulation, and the breakthroughs coming from harness engineering and prompt engineering, how can cybersecurity defenders effectively respond in this adversarial environment?

At Defiant Inc, the company that makes Wordfence, we have always valued curiosity. We have assembled a team with the intellectual vigor to operate at the tempo that today’s adversarial environment requires. Our team has produced PRISM, Eclipse and many internal products that have improved efficiency and added new capability. We also spend a lot of time playing, simply because we can and we love it. Keeping this kind of innovation fun is what helps make it sustainable.

We know that to successfully defend against AI enabled attackers who are themselves engaging in sophisticated prompt and harness engineering, using the latest models, we must do so ourselves, and do it better and at scale.

This mirrors the environment we have always faced, with attackers and defenders having access to powerful technologies that allow both to operate at scale, with those capabilities and that scale constantly increasing. With AI we have seen a stair step up in capability for both attackers and defenders, and the only viable path for defenders is to step up. Then do it again, and again, responding to short term threats, but with long-range planning.

What You Can Do

These are times of great change, great innovation, but also anxiety and uncertainty. Our approach is to build. To innovate. And to have fun doing it. That has worked very well for us as the pace of innovation has increased, as has the volume of weekly reading material. I’ve built a software defined radio that is GPU accelerated, a flight planning agent, and a high frequency trading platform. These are all fields of research I have no business being in, because I lack the formal training one would normally need. And yet I’ve allowed myself to dream big and it has produced results I still find hard to believe.

Our team has built music software, software for the film industry, video games, and other projects, just for fun. When you have to read three new AI articles in a single morning just to stay ahead, it’s not that fun. When you’re reading them to figure out how to make Santa’s Sleigh explode into a shower of presents for a video game for your kids – well that’s a lot more fun and sustainable. (Hat tip Nick for that one)

So keep it fun, but dream big, and that will lead you to the jagged edge of this incredibly exciting time we find ourselves in, and empower you with an understanding of the risks and opportunities. And it sure makes conversations at parties a lot more interesting.

What About the Humans?

I coined a term for a skilled agentic innovator in our organization about 18 months ago: Operator. An Operator is someone who can dream big, and manifest those dreams into reality using agentic coding, prompt engineering and harness engineering. Every member of our team today is an Operator. I could walk up to any Defiant Inc employee and ask them to build me a CUDA application in Rust to process network traffic, and they’d figure out how to make it happen, starting with asking their favorite agent what the heck the CTO is talking about, why they want it, and what success on the project looks like.

So what differentiates one Operator from another? It’s the fundamental non-coding and non-AI knowledge that the Operator brings to the task. Chloe Chamberland is one of the most credentialed security researchers in the world, which is how she was able to conceptualize and supervise the building of PRISM. Marco Wotschka is a very experienced security analyst, which is how he’s able to improve Eclipse as it triages vulnerabilities at scale, and submit PRs back to the team. Brad Osborne is an incredibly smart and creative marketer who has a clear vision of the outcomes he is working to produce, and Brad has built an entire marketing platform to accomplish those goals. Scott Miller heads our customer service, and knows the outcomes he wants to produce for our customers, and is able to create software to accomplish those goals.

Even our teams experiments with music production and other fun projects have fed innovation back into the business in the form of new agentic coding techniques and approaches.

A tragic outcome of this AI revolution is companies that naively thought that AI will be a drop-in replacement for humans, and then proceeded to lay off thousands. I wonder how many Operators they lost: People with a lifetime of specific knowledge that could have been put to work supervising a team of agents to produce valuable business outcomes and innovation that benefited customers.

The researchers that contribute to our bug bounty program are also becoming operators, and putting AI to work in ways that we have not thought of. They may build a more effective harness, or, as happened last week, engineer a new prompt that produces profound new security breakthroughs. We’re optimistic that the security community will embrace this new way of working, and will continue to produce breakthroughs that help secure the WordPress community.

Looking Forward

The future may be uncertain, but the rapid pace of change and innovation is a certainty. We choose to embrace that with a sense of curiosity, excitement and optimism. We’re going to continue having fun, and feeding our research and breakthroughs into products and processes that secure the WordPress Community.

And when it comes to WordPress security in this uncertain world: Wordfence and the team at Defiant Inc has your back.

Mark Maunder – Wordfence Founder and Chief Technology Officer

The post A New Threat Landscape Meets A New Kind of Defender appeared first on Wordfence.

]]> wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade https://swiftupdates.ca/wp2shell-aftermath-the-first-critical-unauthenticated-wordpress-core-rce-in-nearly-a-decade/ Mon, 20 Jul 2026 22:43:28 +0000 https://swiftupdates.ca/wp2shell-aftermath-the-first-critical-unauthenticated-wordpress-core-rce-in-nearly-a-decade/

On Friday, July 17, 2026, the WordPress Security Team released security updates for WordPress Core addressing two vulnerabilities that, when chained together, can lead to unauthenticated remote code execution. The chain, now commonly referred to as wp2shell, was discovered and reported by Adam Kues of Assetnote / Searchlight Cyber, and we want to thank him for his work and responsible disclosure.

WordPress released patched versions 6.8.6, 6.9.5, and 7.0.2 on July 17. The WordPress release notes describe the update as addressing one critical and one high severity security issue, and state that forced automatic updates were enabled for affected versions due to the severity of the issue.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received firewall protection against attacks targeting this vulnerability chain on July 17, 2026, the same day the WordPress patches were released. Wordfence Free users are scheduled to receive the same firewall protection on August 16, 2026, after the standard 30-day delay.

Key takeaways:
  • wp2shell is a critical, unauthenticated remote code execution chain in WordPress Core, tracked as CVE-2026-60137 and CVE-2026-63030. Exploitation does not require a vulnerable plugin, a vulnerable theme, or authenticated access.
  • WordPress released patched versions 6.8.6, 6.9.5, and 7.0.2 on July 17, 2026. WordPress 6.9.x and 7.0.x are affected by the full remote code execution chain; 6.8.x is affected only by the SQL injection vulnerability.
  • Wordfence Premium, Care, and Response customers received firewall protection on July 17, 2026, the day of disclosure. Wordfence Free users receive the same protection on August 16, 2026.
  • Exploitation activity began within hours of the patch release. Wordfence observed endpoint probing and SQL injection attempts the same evening, and public proof-of-concept code was reported in the days that followed.
  • Site owners should update to a patched version immediately, confirm the update completed, and review administrator accounts and recent plugin or file changes. Firewall protection reduces risk but is not a replacement for patching.

What Makes wp2shell So Serious

The wp2shell chain is unusual because it affects WordPress Core itself. It does not require a vulnerable plugin. It does not require a vulnerable theme. It does not require an attacker to log in. It does not require a site administrator to click a malicious link.

A vulnerable WordPress installation exposed to the public internet is enough.

At a high level, the chain combines two issues:

  • CVE-2026-60137, an unauthenticated SQL injection issue involving the author__not_in query parameter.
  • CVE-2026-63030, a REST API batch request route-confusion issue that can be chained with the SQL injection to reach remote code execution.

Adam Kues’ technical writeup explains how the batch API validation and execution paths could be desynchronized, allowing attacker-controlled parameters to reach a route that would normally sanitize them. From there, the SQL injection could be used in a much larger chain involving WordPress post caching, oEmbed cache rows, changesets, and action hooks. The end result is the ability to create an administrator account and then execute code through normal administrator capabilities, such as uploading a plugin.

In practical terms, successful exploitation can give an attacker full administrative control of the WordPress site and the ability to execute code with the privileges of the web server.

Who Is Affected

The affected versions differ slightly between the two vulnerabilities. According to the WordPress 7.0.2 release notes:

  • WordPress 6.9.x is affected by both vulnerabilities and is patched in 6.9.5.
  • WordPress 7.0.x is affected by both vulnerabilities and is patched in 7.0.2.
  • WordPress 6.8.x is affected by the SQL injection vulnerability and is patched in 6.8.6.
  • WordPress versions prior to 6.8 are not affected.

Because 6.8.x is not affected by the REST API batch route-confusion issue, it is not exposed to the full remote code execution chain — but it should still be updated promptly to address the SQL injection.

If your site is running WordPress 6.8.x, 6.9.x, or 7.0.x, you should confirm immediately that it has updated to the appropriate patched version.

Timeline: Disclosure, Protection, and Exploitation

Here is the timeline from official disclosure:

July 17, 2026
The WordPress Security Team released WordPress 7.0.2, 6.9.5, and 6.8.6.

July 17, 2026
Wordfence published an initial PSA and released firewall protection to Wordfence Premium, Care, and Response customers.

July 17, 2026 · 23:29 UTC
In the WAF telemetry available to us, we observed the first exploit-shaped probing against the REST API batch endpoint. This early traffic already showed signs of researchers or attackers testing the route-confusion behavior.

July 17, 2026 · 23:42 UTC
We observed the first clear SQL injection attempt targeting the vulnerable author exclusion behavior through the batch endpoint.

July 18–19, 2026
Researchers had already begun reverse engineering the patch, and proof-of-concept exploit code and independent reproductions began circulating.

July 20, 2026
Searchlight Cyber published Adam Kues’ detailed technical writeup, including the mechanics of the full chain and a public checker at wp2shell.com.

This means exploitation activity began very quickly. Sites that did not update promptly were exposed while public technical details were circulating and attackers were already probing for vulnerable installations.

What We Saw in Attack Data

After reviewing attack data associated with our wp2shell firewall rule, we found that attackers were not merely scanning for the existence of the /wp-json/batch/v1 endpoint. We observed requests attempting to exercise the batch route confusion behavior and, shortly afterward, requests attempting SQL injection. We later confirmed through our own testing that the SQL injection is central to the full RCE chain.

What Wordfence Customers Should Know

Wordfence Premium, Wordfence Care, and Wordfence Response customers received firewall protection on July 17, 2026.

However, a firewall rule is not a replacement for patching WordPress Core. Firewall protection helps reduce exploitability, but the correct long-term remediation is to update to a fixed WordPress version.

What Site Owners Should Do Now

If you manage a WordPress site, take the following steps immediately:

1

Confirm your WordPress Core version.
2

Update to 6.8.6, 6.9.5, or 7.0.2, depending on your current branch.
3

If you are running WordPress 6.9.x or 7.0.x, treat this as especially urgent because those branches are affected by the full chain.
4

Verify that automatic updates completed successfully.
5

Review administrator accounts for unexpected users.
6

Review recent plugin uploads and file changes.
7

Check your site with the public checker at wp2shell.com.
8

If you have Wordfence installed, review firewall logs for blocked requests to /wp-json/batch/v1 or ?rest_route=/batch/v1.

Because the impact can include administrator creation and code execution, any suspected exploitation should be treated as a potential full site compromise.

Conclusion

wp2shell is one of the most significant WordPress Core security events in recent years. The combination of unauthenticated reachability, no plugin or theme requirement, a large global attack surface, a path to administrator access and code execution, as well as public proof-of-concept exploit availability makes this vulnerability chain unusually serious.

The WordPress Security Team moved quickly to release patched versions, and Wordfence Premium, Care, and Response customers received firewall protection on the day of disclosure. But public exploit activity began within hours, and patching remains the most important step site owners can take.

If you have not already confirmed that your site is running a patched WordPress version, do that now.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care.

If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

The post wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade appeared first on Wordfence.

]]> PSA: WordPress Core Patched Unauthenticated Remote Code Execution Vulnerability Chain https://swiftupdates.ca/psa-wordpress-core-patched-unauthenticated-remote-code-execution-vulnerability-chain/ Fri, 17 Jul 2026 23:42:17 +0000 https://swiftupdates.ca/psa-wordpress-core-patched-unauthenticated-remote-code-execution-vulnerability-chain/ On July 17, 2026, the WordPress Security Team released updates to WordPress core addressing two security vulnerabilities. The first is an unauthenticated SQL injection vulnerability identified as CVE-2026-60137, while the second can be chained with the SQL injection to increase its impact to unauthenticated remote code execution and is identified as CVE-2026-63030.

To protect WordPress users while sites are being updated, we will not be providing additional technical details at this time.

The WordPress Security Team has initiated automatic updates for sites running vulnerable versions. However, we strongly recommend confirming as soon as possible that your site has successfully updated to one of the patched versions 6.8.6, 6.9.5, or 7.0.2, if running a 6.8.X, 6.9.X, or 7.0.X version of WordPress core.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule protecting against attacks targeting the remote code execution vulnerability on July 17, 2026. Wordfence Free users will receive the same protection 30 days later, on August 16, 2026.

Vulnerability Summary from Wordfence Intelligence

WordPress Core 6.9 – 7.0.1 – Remote Code Execution via REST API Batch Request Route Confusion

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-63030
Affected Version(s)
Various
Patched Versions
6.9.5, 7.0.2

Affected Software

WordPress [wordpress]

Researcher

WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction, with attacker-controlled parameters and the target route’s input sanitization bypassed, which can be chained with SQL Injection. This may make it possible for attackers to execute code on the server.

More Details >

WordPress Core 6.8 – 7.0.1 – Unauthenticated SQL Injection via author__not_in Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-60137
Affected Version(s)
Various
Patched Versions
6.8.6, 6.9.5, 7.0.2

Affected Software

WordPress [wordpress]

Researchers

WordPress Core is vulnerable to generic SQL Injection via the ‘author__not_in’ parameter in versions 6.8 – 7.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

More Details >

The post PSA: WordPress Core Patched Unauthenticated Remote Code Execution Vulnerability Chain appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (July 6, 2026 to July 12, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-july-6-2026-to-july-12-2026/ Thu, 16 Jul 2026 20:39:56 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-july-6-2026-to-july-12-2026/ Last week, there were 267 vulnerabilities disclosed in 222 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 136 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-925 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-926 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-927 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-928 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 234
Unpatched 33

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 150
High Severity 104
Critical Severity 13

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 94
Missing Authorization 61
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 26
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 12
Authorization Bypass Through User-Controlled Key 11
Deserialization of Untrusted Data 8
Unrestricted Upload of File with Dangerous Type 8
Cross-Site Request Forgery (CSRF) 6
Exposure of Sensitive Information to an Unauthorized Actor 5
Improper Privilege Management 5
Improper Authentication 4
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 4
Incorrect Privilege Assignment 4
Server-Side Request Forgery (SSRF) 4
Improper Control of Generation of Code (‘Code Injection’) 2
Incorrect Authorization 2
Weak Password Recovery Mechanism for Forgotten Password 2
Authentication Bypass by Alternate Name 1
External Control of File Name or Path 1
Improper Input Validation 1
Improper Neutralization of Special Elements used in a Command (‘Command Injection’) 1
Improper Validation of Specified Quantity in Input 1
Improper Verification of Cryptographic Signature 1
Insufficient Verification of Data Authenticity 1
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 1
Weak Password Requirements 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

22

15

10

8

7

6

6

5

5

4

4

4

4

4

4

4

4

4

4

3

3

3

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
13759cde08eee381719e07adbb4bd3e4
hio

1

1

1

1

1

1

1

1

1

1

1

1
91fa2778357b3c3d842647faa82d01ac
1M4

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
8c6ee01bd09c541cf8300189e2960e3f
snr

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder ablocks
Active Products Tables for WooCommerce. Use constructor to create tables  profit-products-tables-for-woocommerce
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress acymailing
Ad Inserter – Ad Manager & AdSense Ads ad-inserter
Advanced Forms for ACF advanced-forms
Advanced iFrame advanced-iframe
Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia affiliaa-affiliate-program-with-mlm
Age Verification & Identity Verification by Token of Trust token-of-trust
Agentic Help Desk Plugin for WordPress – Live Chat, AI Chatbot & Ticketing – ThriveDesk thrivedesk
AI ChatBot for WooCommerce with ChatGPT, Retargeting, Exit Intent woowbot-pro-max
AI ChatBot for WooCommerce – WoowBot woowbot-woocommerce-chatbot
AI Copilot – Content Generator ai-copilot-content-generator
Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit aimogen-pro
All-in-One Video Gallery all-in-one-video-gallery
AMP for WP – Accelerated Mobile Pages accelerated-mobile-pages
Anti-Malware Security and Brute-Force Firewall gotmls
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint
Author Box WP Lens author-box-for-divi
Backstage – Customizer Demo Access backstage
Backup and Staging by WP Time Capsule wp-time-capsule
bbp style pack bbp-style-pack
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot betterdocs
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder bit-form
Block, Suspend, Report for BuddyPress bp-toolkit
Blocks for ACF Fields — Display Custom Fields in the Block Editor acf-field-blocks
Bookero.pl – system rezerwacji online bookeropl
Booking for Appointments and Events Calendar – Amelia ameliabooking
Booking Package booking-package
Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder
Breakdance breakdance
BuddyBoss Platform buddyboss-platform
Bulk Edit Products for WooCommerce – WP Sheet Editor woo-bulk-edit-products
Bulk Order Update for WooCommerce bulk-order-update-for-woocommerce
Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD cart-lift
Catalyst Connect Zoho CRM Client Portal catalyst-connect-client-portal
CF7 Views – Complete Entry Management for Contact Form 7 cf7-views
Chatra Live Chat + ChatBot + Cart Saver chatra-live-chat
Code Engine – PHP Snippets, AI Functions & Automation for WordPress code-engine
Colissimo shipping methods for WooCommerce colissimo-shipping-methods-for-woocommerce
Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo contact-form-7-mailchimp-extension
Contact Form to Chat Apps | Click to Chat to Order – FormyChat social-contact-form
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent gdpr-cookie-consent
CorvusPay WooCommerce Payment Gateway corvuspay-woocommerce-integration
Cost Calculator Builder cost-calculator-builder
Customer Reviews for WooCommerce customer-reviews-woocommerce
Database for Contact Form 7, WPforms, Elementor forms contact-form-entries
DHL eCommerce (Benelux) for WooCommerce dhlpwc
Directorist: AI-Powered Business Directory, Listings & Classified Ads directorist
Divi Form Builder divi-form-builder
Divi Torque Lite – Divi Modules for the Divi Builder & Theme addons-for-divi
Document Gallery document-gallery
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy dokan-lite
DoLogin Security dologin
Download Manager download-manager
DSGVO All in one for WP dsgvo-all-in-one-for-wp
Easy Appointments easy-appointments
Easy Invoice – Invoice Generator, PDF Quotes & Payments easy-invoice
Easy Upload Files During Checkout easy-upload-files-during-checkout
ElementInvader Addons for Elementor elementinvader-addons-for-elementor
Employee, Leave and Recruitment Management System – Crew HRM hr-management
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce erp
Essential Addons for Elementor – Popular Elementor Templates & Widgets essential-addons-for-elementor-lite
Event Tickets and Registration event-tickets
Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce
Eventer eventer
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) wp-event-solution
EventPrime – Events Calendar, Bookings and Tickets eventprime-event-calendar-management
Events Manager – Calendar, Bookings, Tickets, and more! events-manager
Exclusive Addons for Elementor exclusive-addons-for-elementor
Extensions for Leaflet Map extensions-leaflet-map
Flexible Refund for WooCommerce – EU One Click Return flexible-refund-and-return-order-for-woocommerce
FlowForms – Conversational Form Builder flowforms
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder fluentform
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution fluent-crm
Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database form-vibes
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
Free Gifts for WooCommerce free-gifts-for-woocommerce
fresh Podcaster fresh-podcaster
FundEngine – Donation and Crowdfunding Platform wp-fundraising-donation
FunnelKit Funnel Builder Pro funnel-builder-pro
FunnelKit – Funnel Builder for WooCommerce Checkout funnel-builder
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress gamipress
GD Security Headers gd-security-headers
Genolve – Genolve AI Business Graphics, AI Images genolve-toolkit
GEO Plugin by Squirrly SEO squirrly-seo
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) gift-voucher
GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference goodmeet
Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg
GW AI Website Builder gw-ai-website-builder
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms happyforms
Hide My WP Lite hide-wp-login
Highlighting Code Block highlighting-code-block
Hostel hostel
Houzez Login Register houzez-login-register
Hydra Booking — Appointment Scheduling & Booking Calendar hydra-booking
ICS Calendar ics-calendar
Import and export users and customers import-users-from-csv-with-meta
Instant AI Image Generator – Create & Import Images ai-image
Invoice123 saskaita123-lt
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress jeg-elementor-kit
JobSearch WP Job Board wp-jobsearch
JoomSport – for Sports: Team & League, Football, Hockey & more joomsport-sports-league-results-management
Jssor Slider by jssor.com jssor-slider
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
KiviCare – Clinic & Patient Management System (EHR) kivicare-clinic-management-system
LA-Studio Element Kit for Elementor lastudio-element-kit
Lockme calendars integration lockme-calendars-integration
LoginPress Pro loginpress-pro
Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase logo-slider-wp
Loops & Logic tangible-loops-and-logic
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails mail-mint
MailerPress – Newsletter, email marketing & AI automation mailerpress
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. mailoptin
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support
Mang Board WP mangboard
Members – Membership & User Role Editor Plugin members
Membership For WooCommerce membership-for-woocommerce
Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration ecommerce-user-profiles-by-profilegrid
Message Filter for Contact Form 7 cf7-message-filter
miniOrange OTP Login, Verification and SMS Notifications miniorange-otp-verification
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) miniorange-login-openid
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
MStore API – Create Native Android & iOS Apps On The Cloud mstore-api
Mux Video Uploader 2coders-integration-mux-video
My Calendar – Accessible Event Manager my-calendar
MyParcel woocommerce-myparcel
Newsletters newsletters-lite
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder the-plus-addons-for-block-editor
Notification for Telegram notification-for-telegram
PDF Builder for WooCommerce. Create invoices,packing slips and more woo-pdf-invoice-builder
PDF Generator for WordPress pdf-generator-for-wp
PDF Invoices & Packing Slips for WooCommerce woocommerce-pdf-invoices-packing-slips
Peach Payments Gateway wc-peach-payments-gateway
picu – Online Photo Proofing Gallery picu
Planyo online reservation system planyo-online-reservation-system
Points and Rewards for WooCommerce points-and-rewards-for-woocommerce
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder popup-maker
Post Export Import with Media post-export-import-with-media
Post Grid Gutenberg Blocks – PostX ultimate-post
Premium Addons for Elementor – Powerful Elementor Templates & Widgets premium-addons-for-elementor
Print, PDF & Email by PrintFriendly printfriendly
Product Addons and Product Options With Custom Fields – WowAddons product-addons
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Property Hive propertyhive
Proxy & VPN Blocker proxy-vpn-blocker
Razorpay Payment Links for WooCommerce rzp-woocommerce
Real Estate Manager Pro real-estate-manager-pro
Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials testimonial-free
Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl
reCAPTCHA for Asgaros Forum recaptcha-for-asgaros-forum
Recurio – Ultimate Subscription for WooCommerce recurio
RT-Theme 18 Responsive WordPress Theme rt18-extensions
Salon Booking System – Free Version salon-booking-system
Simple Business Directory Pro simple-business-directory-pro
Simple Coherent Form simple-coherent-form
Simple File List simple-file-list
Simple JWT Login – Allows you to use JWT on REST endpoints. simple-jwt-login
SimpLy Gallery simply-gallery-block
SiteGround Email Marketing siteground-email-marketing
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin instagram-feed
Social Share, Social Login and Social Comments Plugin – Super Socializer super-socializer
Solace Extra solace-extra
Sprout Invoices – Client Invoicing & Estimates sprout-invoices
Starboard Suite Reservation Calendars starboard-suite-reservation-calendars
Stock Locations for WooCommerce stock-locations-for-woocommerce
Super Forms – Drag & Drop Form Builder super-forms
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent supportcandy
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments surecart
SureDash – Community, Courses & Member Dashboard suredash
SurfLink – Link Manager & Backup Restore surflink
Swiss Toolkit For WP swiss-toolkit-for-wp
Sympl Repeater for ACF and Elementor acf-repeater-for-elementor
tagDiv Composer td-composer
tagDiv Opt-In Builder td-subscription
Tainacan tainacan
TH Login Registration themehunk-login-registration
Themify Builder themify-builder
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin tourfic
Tutor LMS – eLearning and online course solution tutor
Under Construction Page (Pro) under-construction-page
Unlimited Elements For Elementor unlimited-elements-for-elementor
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration wp-user-frontend
User Management user-management
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP userswp
VikBooking Hotel Booking Engine & PMS vikbooking
Vitepos – Point of Sale (POS) for WooCommerce vitepos-lite
W3 Total Cache w3-total-cache
Wallet for WooCommerce woo-wallet
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce woosquare
WCFM Marketplace – Multivendor Marketplace for WooCommerce wc-multivendor-marketplace
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace wc-multivendor-membership
WCFM – Frontend Manager for WooCommerce wc-frontend-manager
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode coming-soon
White Label CMS white-label-cms
WHMCS Bridge whmcs-bridge
Widget Logic Visual widget-logic-visual
Widgets for Google Reviews wp-reviews-plugin-for-google
Wishlist Member X wishlist-member
WordPress Single Sign-On (SSO) – Multisite Enterprise miniorange-oauth-oidc-single-sign-on
WP Booking System – Booking Calendar Premium wp-booking-system-premium
WP Cost Estimation & Payment Forms Builder lfb-premium
WP Cost Estimation & Payment Forms Builder wp-estimation-form
WP CTA – Call Now Button, Sticky Button & Call to Action Builder easy-sticky-sidebar
WP Easy Pay – Payment and Donation form Builder for Square wp-easy-pay
WP Google Maps Pro wp-google-maps-pro
WP Grid Builder wp-grid-builder
WP Hotel Booking wp-hotel-booking
Wp Js Detect wp-js-detect
WP Learn Manager learn-manager
WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel wp-ultimate-csv-importer
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services chatbot
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System wp-cafe
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell wpfunnels
WPJAM Basic wpjam-basic
WPZOOM Portfolio Lite – Filterable Portfolio Plugin wpzoom-portfolio
ووسلام – همگام سازی ووکامرس و باسلام sync-basalam
گرویتی فرم فارسی persian-gravity-forms
多说社会化评论框 duoshuo

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
777 triple-seven
coaching coaching
Context Blog context-blog
Flatsome flatsome
Grand Photography WordPress grandphotography
Open Shop open-shop

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.3 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57719
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit [aimogen-pro]

Researcher

More Details >

Eventer <= 4.4.2 – Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-9701
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Eventer [eventer]

Researcher

More Details >

Houzez Login Register <= 3.3.3 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57768
Patch Status
Unpatched
Published
Jul 8, 2026

Affected Software

Houzez Login Register [houzez-login-register]

Researcher

More Details >

MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.77.3 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57813
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. [mailoptin]

Researcher

More Details >

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 – Authentication Bypass to Administrator Account Takeover via ‘username_b’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14245
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]

Researcher

More Details >

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 – Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12761
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) [miniorange-login-openid]

Researcher

More Details >

ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 – Unauthenticated Privilege Escalation via Password Reset

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57697
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]

Researcher

More Details >

Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57811
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

More Details >

Super Forms <= 6.3.313 – Unauthenticated Arbitrary File Upload via ‘data’ Parameter (datauristring / value)

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14894
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

More Details >

WP Learn Manager <= 1.1.8 – Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12153
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

WP Learn Manager [learn-manager]

Researcher

More Details >

WPFunnels <= 3.12.7 – Unauthenticated Remote Code Execution via ‘postData’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14345
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

More Details >

Membership For WooCommerce <= 3.1.0 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-57709
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Membership For WooCommerce [membership-for-woocommerce]

Researcher

More Details >

Simple Coherent Form <= 2.4.13 – Unauthenticated Arbitrary File Deletion via ‘id’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-14487
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Simple Coherent Form [simple-coherent-form]

Researcher

More Details >

aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder < 2.9.1 – Authenticated (Contributor+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-57386
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder [ablocks]

Researcher

More Details >

Code Engine <= 0.3.5 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2025-6784
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Code Engine – PHP Snippets, AI Functions & Automation for WordPress [code-engine]

Researcher

More Details >

Divi Form Builder <= 5.1.8 – Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-5523
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Divi Form Builder [divi-form-builder]

Researcher

More Details >

Divi Torque Lite <= 4.2.3 – Cross-Site Request Forgery to Arbitrary Plugin Installation via ‘install_plugin’ REST Endpoint

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-4275
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Divi Torque Lite – Divi Modules for the Divi Builder & Theme [addons-for-divi]

Researcher

More Details >

DoLogin Security <= 4.3 – Unauthenticated Authentication Bypass via Insufficient Randomness via ‘dologin’ Parameter Weak PRNG Token

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-14495
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

DoLogin Security [dologin]

Researcher

More Details >

Essential Addons for Elementor <= 6.6.10 – Authenticated (Contributor+) Account Takeover via Email Header Injection

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-15155
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

More Details >

Genolve – AI image AI video generation <= 5.0.5 – Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-1359
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Genolve – Genolve AI Business Graphics, AI Images [genolve-toolkit]

Researcher

More Details >

MailerPress – Newsletter, email marketing & AI automation <= 2.0.2 – Authenticated (Contributor+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-57410
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

MailerPress – Newsletter, email marketing & AI automation [mailerpress]

Researcher

More Details >

Salon Booking System <= 10.30.32 – Cross-Site Request Forgery to Remote Code Execution via ‘value’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-15070
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Salon Booking System – Free Version [salon-booking-system]

Researcher

More Details >

Simple JWT Login <= 3.6.6 – Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via ‘payload’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-14262
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login]

Researcher

More Details >

Swiss Toolkit For WP <= 1.4.6 – Authenticated (Author+) Arbitrary File Upload via upload_extension_files()

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-2354
Patch Status
Unpatched
Published
Jul 10, 2026

Affected Software

Swiss Toolkit For WP [swiss-toolkit-for-wp]

Researcher

More Details >

UsersWP <= 1.2.65 – Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-13492
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp]

Researcher

More Details >

WHMCS Bridge <= 6.9 – Unauthenticated Arbitrary File Upload via ‘ccce’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-14489
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

WHMCS Bridge [whmcs-bridge]

Researcher

More Details >

Widget Logic Visual <= 1.52 – Authenticated (Subscriber+) Remote Code Execution via ‘nwlv[cod-tag]’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-14158
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Widget Logic Visual [widget-logic-visual]

Researcher

More Details >

WoowBot Pro Max <= 14.1.7 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-57710
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

AI ChatBot for WooCommerce with ChatGPT, Retargeting, Exit Intent [woowbot-pro-max]

Researcher

More Details >

WP Grid Builder <= 2.3.3 – Authenticated (Subscriber+) Privilege Escalation via ‘key’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-13756
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WP Grid Builder [wp-grid-builder]

Researcher

More Details >

WP Ultimate CSV Importer <= 8.0.1 – Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via ‘MappedFields’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-13353
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel [wp-ultimate-csv-importer]

Researcher

More Details >

多说社会化评论框 <= 1.2 – Unauthenticated Privilege Escalation via api.php ‘option’/’value’ Parameters

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-14482
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

多说社会化评论框 [duoshuo]

Researcher

More Details >

777 <= 1.13.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57738
Patch Status
Unpatched
Published
Jul 9, 2026

Affected Software

777 [triple-seven]

Researcher

More Details >

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57713
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager]

Researcher

More Details >

Grand Photography WordPress <= 5.7.8 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57770
Patch Status
Unpatched
Published
Jul 9, 2026

Affected Software

Grand Photography WordPress [grandphotography]

Researcher

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 – Authenticated (Sales Representative+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57389
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57724
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

LoginPress Pro <= 6.2.3 – Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-12598
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

LoginPress Pro [loginpress-pro]

Researcher

More Details >

LoginPress Pro <= 6.2.3 – Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-12595
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

LoginPress Pro [loginpress-pro]

Researcher

More Details >

LoginPress Pro <= 6.2.3 – Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-12597
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

LoginPress Pro [loginpress-pro]

Researcher

More Details >

RT-Theme 18 Responsive WordPress Theme <= 2.5 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57743
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

RT-Theme 18 Responsive WordPress Theme [rt18-extensions]

Researcher

More Details >

RT-Theme 18 Responsive WordPress Theme <= 2.5 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57744
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

RT-Theme 18 Responsive WordPress Theme [rt18-extensions]

Researcher

More Details >

SureCart <= 4.2.3 – Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-7655
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

More Details >

SureDash – Community, Courses & Member Dashboard <= 1.8.0 – Authenticated (SureDash User+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57401
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

More Details >

WCFM – WooCommerce Multivendor Membership <= 2.11.10 – Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-3688
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership]

Researcher

More Details >

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57739
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researcher

More Details >

AI Copilot – Content Generator <= 1.5.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-59515
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

AI Copilot – Content Generator [ai-copilot-content-generator]

Researcher

More Details >

AMP for WP <= 1.1.12 – Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-6101
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages]

Researcher

More Details >

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57714
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

Backstage <= 1.4.2 – Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9842
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Backstage – Customizer Demo Access [backstage]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia <= 2.4.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57702
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Booking Package <= 1.7.20 – Unauthenticated SQL Injection via ’email’ Form Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-15335
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Booking Package [booking-package]

Researcher

More Details >

BuddyBoss Platform <= 3.0.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-59514
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

BuddyBoss Platform [buddyboss-platform]

Researcher

More Details >

Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-59518
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]

Researcher

More Details >

Eventer <= 4.4.2 – Unauthenticated SQL Injection via ‘code’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9700
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Eventer [eventer]

Researcher

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 – Unauthenticated Arbitrary File Download

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57815
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Hide My WP Lite <= 1.3 – Unauthenticated Path Traversal to Arbitrary File Read via ‘he_wrapper_js’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-13347
Patch Status
Unpatched
Published
Jul 9, 2026

Affected Software

Hide My WP Lite [hide-wp-login]

Researcher

More Details >

Jssor Slider by jssor.com <= 3.1.24 – Unauthenticated Arbitrary File Read via ‘url’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-14244
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Jssor Slider by jssor.com [jssor-slider]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57726
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

LA-Studio Element Kit for Elementor <= 1.6.1 – Authenticated (Contributor+) Local File Inclusion via ‘progress_type’ Widget Setting

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-15338
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

LA-Studio Element Kit for Elementor [lastudio-element-kit]

Researcher

More Details >

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.4.0 – Unauthenticated Stripe PaymentIntent Amount-Binding Bypass

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-5356
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

My Calendar <= 3.7.8 – Unauthenticated SQL Injection via ‘mc_auth’ and ‘mc_host’ Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-6854
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

My Calendar – Accessible Event Manager [my-calendar]

Researcher

More Details >

Simple Business Directory Pro <= 15.9.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57707
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Simple Business Directory Pro [simple-business-directory-pro]

Researcher

More Details >

Tainacan <= 1.0.3 – Unauthenticated SQL Injection via ‘geoquery’ REST API Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-6230
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Tainacan [tainacan]

Researcher

More Details >

W3 Total Cache <= 2.9.4 – Unauthenticated Arbitrary File Read via ‘f_array[]’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9282
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

8c6ee01bd09c541cf8300189e2960e3fsnr

More Details >

WP CTA <= 2.2.2 – Unauthenticated Time-Based Blind SQL Injection via ‘fildname’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-4661
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WP CTA – Call Now Button, Sticky Button & Call to Action Builder [easy-sticky-sidebar]

Researcher

More Details >

WPJAM Basic <= 7.0 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57371
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

WPJAM Basic [wpjam-basic]

Researcher

More Details >

Active Products Tables for WooCommerce. Use constructor to create tables  <= 1.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57409
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Active Products Tables for WooCommerce. Use constructor to create tables  [profit-products-tables-for-woocommerce]

Researcher

More Details >

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57741
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researcher

More Details >

Anti-Malware Security and Brute-Force Firewall <= 4.23.89 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57691
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Anti-Malware Security and Brute-Force Firewall [gotmls]

Researcher

More Details >

Breakdance <= 2.7.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57735
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Breakdance [breakdance]

Researcher

More Details >

Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD <= 3.1.57 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57417
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD [cart-lift]

Researcher

More Details >

CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57411
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

CF7 Views – Complete Entry Management for Contact Form 7 [cf7-views]

Researcher

More Details >

Coaching <= 3.9.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57397
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

coaching [coaching]

Researcher

More Details >

Connect Contact Form 7 and Mailchimp <= 0.9.78.06 – Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-15000
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo [contact-form-7-mailchimp-extension]

Researcher

More Details >

Contact Form to Chat Apps | Click to Chat to Order – FormyChat <= 2.15.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57379
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Contact Form to Chat Apps | Click to Chat to Order – FormyChat [social-contact-form]

Researcher

More Details >

CorvusPay WooCommerce Payment Gateway <= 2.7.4 – Unauthenticated Stored Cross-Site Scripting via ‘approval_code’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-6939
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

CorvusPay WooCommerce Payment Gateway [corvuspay-woocommerce-integration]

Researcher

More Details >

Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57708
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Database for Contact Form 7, WPforms, Elementor forms [contact-form-entries]

Researcher

More Details >

Document Gallery <= 5.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57695
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Document Gallery [document-gallery]

Researcher

More Details >

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57706
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

ElementInvader Addons for Elementor <= 1.4.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57376
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

ElementInvader Addons for Elementor [elementinvader-addons-for-elementor]

Researcher

More Details >

EventPrime <= 4.3.4.2 – Unauthenticated Stored Cross-Site Scripting via ‘new_event_type_background_color’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13441
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]

Researcher

More Details >

Extensions for Leaflet Map <= 5.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57380
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Extensions for Leaflet Map [extensions-leaflet-map]

Researcher

More Details >

FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57715
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluent-crm]

Researcher

More Details >

Form Vibes <= 1.5.2 – Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13378
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database [form-vibes]

Researcher

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57814
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Free Gifts for WooCommerce <= 13.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57396
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Free Gifts for WooCommerce [free-gifts-for-woocommerce]

Researcher

More Details >

FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57816
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

FunnelKit – Funnel Builder for WooCommerce Checkout [funnel-builder]

Researcher

More Details >

FunnelKit Funnel Builder Pro <= 3.15.0.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57374
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

FunnelKit Funnel Builder Pro [funnel-builder-pro]

Researcher

More Details >

GD Security Headers <= 1.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57403
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

GD Security Headers [gd-security-headers]

Researcher

More Details >

Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.7.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57415
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) [gift-voucher]

Researcher

More Details >

Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.44 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57388
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]

Researcher

More Details >

ICS Calendar <= 12.1.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-59516
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

ICS Calendar [ics-calendar]

Researcher

More Details >

JobSearch WP Job Board <= 3.2.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57383
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

JobSearch WP Job Board [wp-jobsearch]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57725
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Motors <= 1.4.112 – Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13114
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Newsletters <= 4.14 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57394
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57668
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

picu – Online Photo Proofing Gallery <= 3.5.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57387
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

picu – Online Photo Proofing Gallery [picu]

Researcher

More Details >

Planyo online reservation system <= 3.0 – Unauthenticated Server-Side Request Forgery via ‘ulap_url’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-3576
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Planyo online reservation system [planyo-online-reservation-system]

Researchers

More Details >

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 – Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-8848
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker]

Researcher

More Details >

Post Export Import with Media <= 1.13.1 – Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13430
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Post Export Import with Media [post-export-import-with-media]

Researchers

More Details >

Property Hive <= 2.2.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57381
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Property Hive [propertyhive]

Researcher

More Details >

Proxy & VPN Blocker <= 3.5.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57399
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Proxy & VPN Blocker [proxy-vpn-blocker]

Researcher

More Details >

Real Estate Manager Pro <= 12.8.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57398
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Real Estate Manager Pro [real-estate-manager-pro]

Researcher

More Details >

SEO Plugin by Squirrly SEO <= 14.0.0 – Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-1667
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

GEO Plugin by Squirrly SEO [squirrly-seo]

Researcher

More Details >

SiteGround Email Marketing <= 1.7.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57416
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

SiteGround Email Marketing [siteground-email-marketing]

Researcher

More Details >

tagDiv Opt-In Builder <= 1.7.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57732
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

tagDiv Opt-In Builder [td-subscription]

Researcher

More Details >

Themify Builder <= 7.7.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57369
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Themify Builder [themify-builder]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.12 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57718
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.8 – Unauthenticated Stored Cross-Site Scripting via ‘special_requests’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-6818
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.8 – Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-6820
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 – Unauthenticated Stored Cross-Site Scripting via ‘customerInfos’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-9253
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

WP Cost Estimation & Payment Forms Builder [lfb-premium]
WP Cost Estimation & Payment Forms Builder [wp-estimation-form]

Researcher

More Details >

WP Google Maps Pro <= 10.1.02 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57767
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WP Google Maps Pro [wp-google-maps-pro]

Researcher

More Details >

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57363
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

More Details >

WPJAM Basic <= 7.0 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57372
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

WPJAM Basic [wpjam-basic]

Researcher

More Details >

WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.29 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57712
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WPZOOM Portfolio Lite – Filterable Portfolio Plugin [wpzoom-portfolio]

Researcher

More Details >

Bit Form <= 3.1.1 – Authenticated (Subscriber+) Arbitrary File Deletion via ‘_old’ Parameter

7.1

CVSS Rating
7.1 (High)
CVE-ID

CVE-2026-14372
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder [bit-form]

Researchers

More Details >

HappyForms <= 1.26.12 – Authenticated (Admin+) Local File Inclusion

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2025-11977
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms [happyforms]

Researcher

More Details >

Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials <= 3.1.15 – Authenticated (Administrator+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-59521
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials [testimonial-free]

Researcher

More Details >

WPFunnels <= 3.12.7 – Authenticated (Administrator+) Local File Inclusion via ‘logKey’ Parameter

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-13080
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

More Details >

Backup and Staging by WP Time Capsule <= 1.22.26 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-8996
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Backup and Staging by WP Time Capsule [wp-time-capsule]

Researcher

More Details >

BetterDocs <= 4.6.0 – Authenticated (Custom+) SQL Injection via ‘lang’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-15104
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot [betterdocs]

Researcher

More Details >

Blocks for ACF Fields <= 1.6.2 – Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via ‘id’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12428
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Blocks for ACF Fields — Display Custom Fields in the Block Editor [acf-field-blocks]

Researcher

More Details >

ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 – Authenticated (HR Manager+) SQL Injection via ‘orderby’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13011
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]

Researcher

More Details >

JoomSport <= 5.7.9 – Authenticated (Contributor+) SQL Injection via ‘event’ Shortcode Attribute

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13010
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

JoomSport – for Sports: Team & League, Football, Hockey & more [joomsport-sports-league-results-management]

Researcher

More Details >

KiviCare <= 4.5.0 – Authenticated (Doctor+) SQL Injection via ‘orderby’ Parameter in DoctorSessionController

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-15073
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]

Researcher

More Details >

KiviCare <= 4.5.0 – Authenticated (Doctor+) SQL Injection via ‘orderby’ Parameter in KCQueryBuilder

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-15072
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]

Researcher

More Details >

Majestic Support <= 1.1.9 – Authenticated (Subscriber+) SQL Injection via ‘val’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13262
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]

Researcher

More Details >

UnderConstructionPage PRO <= 5.76 – Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-11426
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Under Construction Page (Pro) [under-construction-page]

Researcher

More Details >

Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 – Authenticated (Cashier+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57385
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]

Researcher

More Details >

WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.4 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57810
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce [woosquare]

Researcher

More Details >

AcyMailing <= 10.10.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘alignment’ Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12170
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researchers

More Details >

Ad Inserter – Ad Manager & AdSense Ads <= 2.8.11 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57693
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

Advanced iFrame <= 2026.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block ‘additional’ Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6742
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Advanced iFrame [advanced-iframe]

Researcher

More Details >

AI ChatBot for eCommerce – WoowBot <= 4.6.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57414
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

AI ChatBot for WooCommerce – WoowBot [woowbot-woocommerce-chatbot]

Researcher

More Details >

All-in-One Video Gallery <= 4.8.5 – Authenticated (Subscriber+) Server-Side Request Forgery via ‘vdl’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12123
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

All-in-One Video Gallery [all-in-one-video-gallery]

Researcher

More Details >

Author Box WP Lens <= 2.1.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57420
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Author Box WP Lens [author-box-for-divi]

Researcher

More Details >

bbp style pack <= 6.4.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15010
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

bbp style pack [bbp-style-pack]

Researcher

More Details >

Block, Suspend, Report for BuddyPress <= 3.6.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘link’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4653
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Block, Suspend, Report for BuddyPress [bp-toolkit]

Researcher

More Details >

Bookero.pl <= 2.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6910
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Bookero.pl – system rezerwacji online [bookeropl]

Researcher

More Details >

Customer Reviews for WooCommerce <= 5.113.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘color’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13771
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Customer Reviews for WooCommerce [customer-reviews-woocommerce]

Researchers

More Details >

Download Manager <= 3.3.61 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘note_before’ and ‘note_after’ Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14343
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Essential Addons for Elementor <= 6.6.2 – Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6459
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

More Details >

Eventin <= 4.1.15 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘etn_faq_content’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12924
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution]

Researcher

More Details >

Exclusive Addons for Elementor <= 2.7.9.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11328
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

Exclusive Addons for Elementor [exclusive-addons-for-elementor]

Researcher

More Details >

Flexible Refund for WooCommerce – EU One Click Return <= 1.0.51 – Authenticated (Customer+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57402
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Flexible Refund for WooCommerce – EU One Click Return [flexible-refund-and-return-order-for-woocommerce]

Researcher

More Details >

fresh Podcaster <= 1.0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘freshpodcaster’ Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-1382
Patch Status
Unpatched
Published
Jul 10, 2026

Affected Software

fresh Podcaster [fresh-podcaster]

Researcher

More Details >

FunnelKit Funnel Builder Pro <= 3.15.0.4 – Authenticated (Customer+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57373
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

FunnelKit Funnel Builder Pro [funnel-builder-pro]

Researcher

More Details >

Hostel <= 1.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘wphostel-book’ Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-3907
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Hostel [hostel]

Researcher

More Details >

Instant AI Image Generator – Create & Import Images <= 2.1.4 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57413
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Instant AI Image Generator – Create & Import Images [ai-image]

Researcher

More Details >

Jeg Kit for Elementor <= 3.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘sg_body_description’ Parameter via ‘jkit_image_box’ Shortcode/Widget

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13710
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]

Researcher

More Details >

Logo Slider <= 5.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘lgx_tooltip_position’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13247
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase [logo-slider-wp]

Researchers

More Details >

Loops & Logic <= 4.2.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57391
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Loops & Logic [tangible-loops-and-logic]

Researcher

More Details >

Mixed Media Gallery Blocks <= 3.3.3.1 – Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5743
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

SimpLy Gallery [simply-gallery-block]

Researcher

More Details >

Nexter Blocks <= 4.7.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘commentIcon’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6740
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder [the-plus-addons-for-block-editor]

Researcher

More Details >

PDF Generator for WordPress <= 1.6.2 – Authenticated (Subscriber+) Server-side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57407
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

PDF Generator for WordPress [pdf-generator-for-wp]

Researcher

More Details >

Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘moreResultsText’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13253
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Post Grid Gutenberg Blocks – PostX [ultimate-post]

Researcher

More Details >

reCAPTCHA for Asgaros Forum <= 1.1.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57365
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

reCAPTCHA for Asgaros Forum [recaptcha-for-asgaros-forum]

Researcher

More Details >

Starboard Suite Reservation Calendars <= 3.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-13968
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Starboard Suite Reservation Calendars [starboard-suite-reservation-calendars]

Researcher

More Details >

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.4.8 – Authenticated (Customer+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57711
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy]

Researcher

More Details >

Sympl Repeater for ACF and Elementor <= 2.3 – Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10570
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Sympl Repeater for ACF and Elementor [acf-repeater-for-elementor]

Researcher

More Details >

Themify Builder <= 7.7.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘height_slider’ Slider Module Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15097
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Themify Builder [themify-builder]

Researcher

More Details >

Themify Builder <= 7.7.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module ‘b_width_map’ Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15096
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Themify Builder [themify-builder]

Researcher

More Details >

WCFM Marketplace <= 3.7.3 – Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment ‘post_title’

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12126
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]

Researcher

More Details >

Website Builder by SeedProd – Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘seedprodnestedmenuwidget’ Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-14785
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon]

Researcher

More Details >

WishList Member X <= 3.32.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57384
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Wishlist Member X [wishlist-member]

Researcher

More Details >

Themehunk Login Registration <= 1.0.2 – Unauthenticated Privilege Escalation via ‘role’ Parameter

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-14250
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

TH Login Registration [themehunk-login-registration]

Researcher

More Details >

Bopo – WooCommerce Product Bundle Builder <= 1.2.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57422
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Bopo – WooCommerce Product Bundle Builder [bopo-woo-product-bundle-builder]

Researcher

More Details >

Flatsome <= 3.20.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57728
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

Flatsome [flatsome]

Researcher

More Details >

ICS Calendar <= 12.0.9 – Reflected Cross-Site Scripting via ‘htmltagtitle’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-9838
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

ICS Calendar [ics-calendar]

Researcher

More Details >

Mang Board WP <= 2.3.4 – Reflected Cross-Site Scripting via ‘stag’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-13334
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Mang Board WP [mangboard]

Researcher

More Details >

Message Filter for Contact Form 7 <= 1.6.3.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57423
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Message Filter for Contact Form 7 [cf7-message-filter]

Researcher

More Details >

RT-Theme 18 Responsive WordPress Theme <= 2.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57745
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

RT-Theme 18 Responsive WordPress Theme [rt18-extensions]

Researcher

More Details >

Simple File List <= 6.3.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57382
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Simple File List [simple-file-list]

Researcher

More Details >

Social Share, Social Login and Social Comments Plugin <= 7.14.5 – Reflected Cross-Site Scripting via ‘heateor_mastodon_share’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-11798
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Social Share, Social Login and Social Comments Plugin – Super Socializer [super-socializer]

Researcher

More Details >

tagDiv Composer <= 5.4.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57734
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

tagDiv Composer [td-composer]

Researcher

More Details >

WP Hotel Booking <= 2.3.1 – Reflected Cross-Site Scripting via ‘check_in_date’ and ‘check_out_date’ Parameters

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-11392
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

91fa2778357b3c3d842647faa82d01ac1M4

More Details >

Fluent Forms <= 6.2.1 – Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via ‘subscription_id’

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-5069
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

More Details >

WPCafe <= 3.0.14 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-11818
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

More Details >

Abandoned Cart Recovery for WooCommerce <= 1.1.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57698
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Abandoned Cart Recovery for WooCommerce [woo-abandoned-cart-recovery]

Researcher

More Details >

Advanced Forms for ACF <= 1.9.3.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57378
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Advanced Forms for ACF [advanced-forms]

Researcher

More Details >

Age Verification & Identity Verification by Token of Trust <= 4.0.2 – Missing Authorization to Unauthenticated Information Exposure via ‘tot_export_table’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-7558
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Age Verification & Identity Verification by Token of Trust [token-of-trust]

Researcher

More Details >

AI Chatbot & Workflow Automation by AIWU <= 1.4.12 – Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions ‘removeGroup’ and ‘clear’

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6803
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

AI Copilot – Content Generator [ai-copilot-content-generator]

Researcher

More Details >

AI Chatbot & Workflow Automation by AIWU <= 1.4.12 – Missing Authorization to Unauthenticated Arbitrary Modification via ‘publishTasks’ and ‘unpublishTasks’ AJAX Actions

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6804
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

AI Copilot – Content Generator [ai-copilot-content-generator]

Researcher

More Details >

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.11 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-59523
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]

Researcher

More Details >

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57812
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]

Researcher

13759cde08eee381719e07adbb4bd3e4hio

More Details >

Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More <= 2.2.0 – Unauthenticated Business Logic Flaw

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57364
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More [better-payment]

Researcher

More Details >

Bulk Order Update for WooCommerce <= 1.6 – Unauthenticated Arbitrary File Read via ‘csv_url’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-14500
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Bulk Order Update for WooCommerce [bulk-order-update-for-woocommerce]

Researcher

More Details >

Context Blog <= 1.3.5 – Unauthenticated Sensitive Information Exposure via ‘postID’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6801
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Context Blog [context-blog]

Researcher

More Details >

CorvusPay WooCommerce Payment Gateway <= 2.7.4 – Missing Authorization to Unauthenticated Arbitrary Order Cancellation via ‘order_number’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9028
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

CorvusPay WooCommerce Payment Gateway [corvuspay-woocommerce-integration]

Researcher

More Details >

CorvusPay WooCommerce Payment Gateway <= 2.7.4 – Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9027
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

CorvusPay WooCommerce Payment Gateway [corvuspay-woocommerce-integration]

Researcher

More Details >

Cost Calculator Builder <= 4.0.11 – Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-10865
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Cost Calculator Builder [cost-calculator-builder]

Researcher

More Details >

Easy Invoice <= 2.1.19 – Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9021
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Easy Invoice – Invoice Generator, PDF Quotes & Payments [easy-invoice]

Researcher

More Details >

Easy Upload Files During Checkout <= 3.0.1 – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via ‘eufdc-delete’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6802
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Easy Upload Files During Checkout [easy-upload-files-during-checkout]

Researcher

More Details >

Event Tickets and Registration <= 5.28.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57705
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Event Tickets Manager for WooCommerce <= 1.5.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57400
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Event Tickets Manager for WooCommerce [event-tickets-manager-for-woocommerce]

Researcher

More Details >

Eventin 4.0.26 – 4.1.15 – Missing Authorization to Unauthenticated Payment Bypass via REST API

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-13039
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution]

Researcher

More Details >

Flatsome <= 3.20.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57729
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

Flatsome [flatsome]

Researcher

More Details >

FundEngine – Donation and Crowdfunding Platform <= 1.7.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57406
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]

Researcher

More Details >

GamiPress <= 7.9.4 – Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via ‘access’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-13450
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

More Details >

Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.6.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57412
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) [gift-voucher]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57727
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

KiviCare <= 4.4.0 – Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11990
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]

Researcher

More Details >

Members <= 3.2.22 – Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12426
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Members – Membership & User Role Editor Plugin [members]

Researcher

More Details >

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57375
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

MStore API – Create Native Android & iOS Apps On The Cloud [mstore-api]

Researcher

More Details >

NEX-Forms <= 9.2.2 – Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9017
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

Peach Payments Gateway <= 4.0.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57408
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Peach Payments Gateway [wc-peach-payments-gateway]

Researcher

More Details >

Product Addons and Product Options With Custom Fields – WowAddons <= 1.6.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57377
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Product Addons and Product Options With Custom Fields – WowAddons [product-addons]

Researcher

More Details >

Razorpay Payment Links for WooCommerce <= 2.1.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57424
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Razorpay Payment Links for WooCommerce [rzp-woocommerce]

Researcher

More Details >

Solace Extra <= 1.5.3 – Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-13250
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Solace Extra [solace-extra]

Researcher

More Details >

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57392
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin [tourfic]

Researcher

More Details >

User Frontend <= 4.3.7 – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via ‘attach_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12406
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration [wp-user-frontend]

Researcher

More Details >

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 – Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-5459
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration [wp-user-frontend]

Researcher

More Details >

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 – Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via ‘wpuf_files_data’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12418
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration [wp-user-frontend]

Researcher

More Details >

User Management <= 1.2 – Missing Authorization to Unauthenticated Plugin Settings Modification

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12097
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

User Management [user-management]

Researcher

More Details >

WCFM – Frontend Manager for WooCommerce <= 6.7.27 – Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12994
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WCFM – Frontend Manager for WooCommerce [wc-frontend-manager]

Researcher

More Details >

WordPress Single Sign-On (SSO) – Multisite Premium <= 38.5.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57807
Patch Status
Unpatched
Published
Jul 9, 2026

Affected Software

WordPress Single Sign-On (SSO) – Multisite Enterprise [miniorange-oauth-oidc-single-sign-on]

Researcher

More Details >

WP Hotel Booking <= 2.3.1 – Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11901
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

More Details >

Catalyst Connect Zoho CRM Client Portal <= 2.2.0 – Authenticated (Administrator+) SQL Injection via uid Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2025-5017
Patch Status
Unpatched
Published
Jul 10, 2026

Affected Software

Catalyst Connect Zoho CRM Client Portal [catalyst-connect-client-portal]

Researcher

More Details >

Cookie Banner for GDPR / CCPA <= 4.3.6 – Authenticated (Administrator+) SQL Injection via ‘scan_id’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-14475
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent [gdpr-cookie-consent]

Researcher

More Details >

Mail Mint <= 1.24.1 – Authenticated (Administrator+) SQL Injection via ‘recipients’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-12918
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails [mail-mint]

Researcher

More Details >

Mail Mint <= 1.24.2 – Authenticated (Administrator+) SQL Injection via ‘contact_ids’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-14342
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails [mail-mint]

Researcher

More Details >

Premium Addons for Elementor <= 4.11.84 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘premium_tooltip_text’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-12141
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]

Researchers

More Details >

Recurio <= 1.1.3 – Authenticated (Shop Manager+) SQL Injection via ‘data’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-12936
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

Recurio – Ultimate Subscription for WooCommerce [recurio]

Researcher

More Details >

sync-basalam <= 3.0.2 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-61955
Patch Status
Patched
Published
Jul 12, 2026

Affected Software

گرویتی فرم فارسی [persian-gravity-forms]

Researcher

More Details >

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 – Cross-Site Request Forgery to oEmbed Access Token Overwrite via ‘sbi_access_token’ Parameter

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-12002
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed]

Researcher

More Details >

Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘chatra-code’ Setting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12041
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Chatra Live Chat + ChatBot + Cart Saver [chatra-live-chat]

Researcher

More Details >

Highlighting Code Block <= 2.2.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘font_family’ Setting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12108
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Highlighting Code Block [highlighting-code-block]

Researcher

More Details >

Lockme OAuth2 calendars integration <= 2.11.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘App ID’ Setting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-3367
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Lockme calendars integration [lockme-calendars-integration]

Researcher

More Details >

Print, PDF, Email by PrintFriendly <= 5.5.10 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘content_position_css’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-9738
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Print, PDF & Email by PrintFriendly [printfriendly]

Researcher

More Details >

White Label CMS <= 2.7.12 – Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-11898
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

White Label CMS [white-label-cms]

Researcher

More Details >

Widgets for Google Reviews <= 13.3 – Authenticated (Editor+) Stored Cross-Site Scripting via ‘fomo-title’ and ‘fomo-text’ Parameters

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-11591
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Widgets for Google Reviews [wp-reviews-plugin-for-google]

Researcher

More Details >

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57740
Patch Status
Unpatched
Published
Jul 6, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researcher

More Details >

Affilia <= 3.3.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7559
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia [affiliaa-affiliate-program-with-mlm]

Researcher

More Details >

Bulk Edit Products for WooCommerce – WP Sheet Editor <= 1.8.21 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-61952
Patch Status
Patched
Published
Jul 12, 2026

Affected Software

Bulk Edit Products for WooCommerce – WP Sheet Editor [woo-bulk-edit-products]

Researcher

More Details >

Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9240
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Colissimo shipping methods for WooCommerce [colissimo-shipping-methods-for-woocommerce]

Researcher

More Details >

Cookie Banner for GDPR / CCPA <= 4.3.6 – Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12955
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent [gdpr-cookie-consent]

Researcher

More Details >

DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9235
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

DHL eCommerce (Benelux) for WooCommerce [dhlpwc]

Researcher

More Details >

DSGVO All in one for WP <= 4.9 – Missing Authorization to Authenticated (Subscriber+) Settings Reset

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-4298
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

DSGVO All in one for WP [dsgvo-all-in-one-for-wp]

Researchers

More Details >

Easy Appointments <= 3.12.27 – Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11992
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Employee, Leave and Recruitment Management System <= 1.2.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9237
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Employee, Leave and Recruitment Management System – Crew HRM [hr-management]

Researcher

More Details >

FlowForms <= 1.1.1 – Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API ‘/flowforms/v1/forms/{id}’ Endpoints

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12400
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

FlowForms – Conversational Form Builder [flowforms]

Researcher

More Details >

GoodMeet <= 1.1.8 – Cross-Site Request Forgery to Google Meet Credential Reset via ‘goodmeet_reset_google_meet_credential’

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-6440
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference [goodmeet]

Researcher

More Details >

GW AI Website Builder <= 1.0.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-1946
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

GW AI Website Builder [gw-ai-website-builder]

Researcher

More Details >

Hydra Booking <= 1.2.1 – Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via ‘booking_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12433
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]

Researcher

More Details >

Import and export users and customers <= 2.4.0 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15026
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

Invoice123 <= 1.7.0 – Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9857
Patch Status
Patched
Published
Jul 9, 2026

Affected Software

Invoice123 [saskaita123-lt]

Researcher

More Details >

Memberships and User Profiles for WooCommerce <= 3.4 – Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11359
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration [ecommerce-user-profiles-by-profilegrid]

Researcher

More Details >

Mux Video Uploader <= 1.1.4 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7544
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Mux Video Uploader [2coders-integration-mux-video]

Researcher

More Details >

MyParcel <= 4.25.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modification via wcmp_get_shipment_options and wcmp_save_shipment_options AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8678
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

MyParcel [woocommerce-myparcel]

Researchers

More Details >

Notification for Telegram <= 3.5.1 – Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7620
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Notification for Telegram [notification-for-telegram]

Researcher

More Details >

Open Shop <= 1.7.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57405
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Open Shop [open-shop]

Researcher

More Details >

PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 – Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57393
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]

Researcher

More Details >

PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via ‘order_id’ Shortcode Attribute

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-13116
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips]

Researcher

More Details >

Points and Rewards for WooCommerce <= 2.10.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10628
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Points and Rewards for WooCommerce [points-and-rewards-for-woocommerce]

Researcher

More Details >

Sprout Invoices – Client Invoicing & Estimates <= 20.8.13 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57418
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]

Researcher

More Details >

Stock Locations for WooCommerce <= 3.1.8 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57419
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Stock Locations for WooCommerce [stock-locations-for-woocommerce]

Researcher

More Details >

SurfLink < 2.6.0 – Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via ‘surfl_import_410’ AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-3552
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

SurfLink – Link Manager & Backup Restore [surflink]

Researcher

More Details >

sync-basalam <= 1.9.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-61956
Patch Status
Patched
Published
Jul 12, 2026

Affected Software

ووسلام – همگام سازی ووکامرس و باسلام [sync-basalam]

Researcher

More Details >

ThriveDesk <= 2.1.7 – Missing Authorization to Authenticated (Subscriber+) Cache Deletion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-1832
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Agentic Help Desk Plugin for WordPress – Live Chat, AI Chatbot & Ticketing – ThriveDesk [thrivedesk]

Researcher

More Details >

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57395
Patch Status
Patched
Published
Jul 8, 2026

Affected Software

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin [tourfic]

Researcher

More Details >

Tutor LMS – eLearning and online course solution <= 3.9.13 – Unauthenticated Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57694
Patch Status
Patched
Published
Jul 6, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Wallet for WooCommerce <= 1.6.4 – Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12103
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

Wallet for WooCommerce [woo-wallet]

Researcher

More Details >

WCFM – Frontend Manager for WooCommerce <= 6.7.27 – Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10041
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WCFM – Frontend Manager for WooCommerce [wc-frontend-manager]

Researchers

More Details >

WP Booking System – Booking Calendar Premium < 5.12.8.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57367
Patch Status
Patched
Published
Jul 7, 2026

Affected Software

WP Booking System – Booking Calendar Premium [wp-booking-system-premium]

Researcher

More Details >

WP Easy Pay <= 4.5.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12738
Patch Status
Patched
Published
Jul 10, 2026

Affected Software

WP Easy Pay – Payment and Donation form Builder for Square [wp-easy-pay]

Researcher

More Details >

Wp Js Detect <= 1.0.9 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9731
Patch Status
Unpatched
Published
Jul 7, 2026

Affected Software

Wp Js Detect [wp-js-detect]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 6, 2026 to July 12, 2026) appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (June 29, 2026 to July 5, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-29-2026-to-july-5-2026/ Thu, 09 Jul 2026 16:40:21 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-29-2026-to-july-5-2026/ Last week, there were 246 vulnerabilities disclosed in 179 WordPress Plugins and 40 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 100 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 158
Unpatched 88

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 150
High Severity 87
Critical Severity 9

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 87
Missing Authorization 50
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 25
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 19
Authorization Bypass Through User-Controlled Key 12
Cross-Site Request Forgery (CSRF) 12
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 11
Exposure of Sensitive Information to an Unauthorized Actor 7
Deserialization of Untrusted Data 4
Improper Control of Generation of Code (‘Code Injection’) 4
Improper Privilege Management 3
Server-Side Request Forgery (SSRF) 3
Unrestricted Upload of File with Dangerous Type 3
External Control of File Name or Path 2
Improper Authentication 1
Improper Neutralization of CRLF Sequences (‘CRLF Injection’) 1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) 1
Improper Neutralization of Special Elements used in a Command (‘Command Injection’) 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

34

18

14

13

12

7

5

5

5

5

5

4

4

4

4

4

4

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
5b840087cae0a13b411eb404ad102a47
Yat

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Academy LMS academy
Ad Inserter – Ad Manager & AdSense Ads ad-inserter
Admin and Site Enhancements (ASE) Pro admin-site-enhancements-pro
Advanced Booking & Appointment System – Webba Booking Calendar webba-booking-lite
Advanced Contact form 7 DB advanced-cf7-db
Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking
Ajax Load More – Filters ajax-load-more-filters
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship
ApplyOnline – Application Form Builder and Manager apply-online
Appointment Booking Calendar appointment-booking-calendar
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint
Appointment Bookings for Zoom GoogleMeet and more – Wappointment wappointment
AR for WooCommerce ar-for-woocommerce
AR for WordPress ar-for-wordpress
ARforms arforms
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup armember
Automotive Listings automotive
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net woo-bulk-editor
Blocksy Companion blocksy-companion
Blocksy Companion Pro blocksy-companion-pro
Booked – Appointment Booking for WordPress booked
Booking calendar, Appointment Booking System booking-calendar
BookingPress Appointment Booking Pro bookingpress-appointment-booking-pro
Business Directory Plugin – Easy Listing Directories for WordPress business-directory-plugin
Classified Listing – AI-Powered Classified ads & Business Directory classified-listing
CM Business Directory – Optimise and showcase local business cm-business-directory
CodePeople Post Map for Google Maps codepeople-post-map
Colissimo shipping methods for WooCommerce colissimo-shipping-methods-for-woocommerce
Comments – wpDiscuz wpdiscuz
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent gdpr-cookie-consent
CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor mihdan-index-now
CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x woo-multi-currency
Custom Field Template custom-field-template
Custom Payment Gateways for WooCommerce custom-payment-gateways-woocommerce
cws-svgicons cws-svgicons
Database for Contact Form 7, WPforms, Elementor forms contact-form-entries
Divi Form Builder divi-form-builder
Dokan Pro dokan-pro
Download Manager download-manager
eCommerce Product Catalog Plugin for WordPress ecommerce-product-catalog
Editorial Rating – Product Review & Rating System editorial-rating
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress email-subscribers
Embed Privacy embed-privacy
Enable Media Replace enable-media-replace
Envision Page Builder – A collection of WordPress Gutenberg blocks & templates envision-page-builder
Envo’s Templates & Widgets for Elementor and WooCommerce envo-elementor-for-woocommerce
Event Organiser event-organiser
EventON (Pro) – WordPress Virtual Event Calendar Plugin eventON
Exclusive Addons for Elementor exclusive-addons-for-elementor
Export User Data export-user-data
ez Form Calculator Premium ez-form-calculator-premium
Five Star Business Profile and Schema business-profile
FormLayer formlayer
FV Flowplayer Video Player fv-wordpress-flowplayer
GD Rating System gd-rating-system
GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content geeky-bot
GenerateBlocks generateblocks
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
GiveWP – Donation Plugin and Fundraising Platform give
Golo Framework golo-framework
Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg
HandL UTM Grabber / Tracker handl-utm-grabber
Heateor Social Login WordPress heateor-social-login
Houzez Property Feed houzez-property-feed
HubSpot All-In-One Marketing – Forms, Popups, Live Chat leadin
Image Optimization – Compress Images and Convert to WebP or AVIF image-optimization
iNET Webkit inet-webkit
Insert Pages insert-pages
Internal Links Manager seo-automated-link-building
Japanized for WooCommerce woocommerce-for-japan
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
JetWidgets For Elementor jetwidgets-for-elementor
JoomSport – for Sports: Team & League, Football, Hockey & more joomsport-sports-league-results-management
JSON API User json-api-user
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor kadence-blocks
Kali Forms — Contact Form & Drag-and-Drop Builder kali-forms
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages page-builder-add
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
Link Whisper Free link-whisper
Link Whisper Premium link-whisper-premium
MainWP Dashboard: Self-hosted WordPress Management for Agencies mainwp
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MeetingHub – Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet meetinghub
Module PRO modula
MoreConvert Wishlist for WooCommerce smart-wishlist-for-more-convert
Mosaic Gallery – Advanced Gallery mosaic-gallery-advanced-gallery
MotoPress Appointment Booking motopress-appointment-lite
MotoPress Hotel Booking motopress-hotel-booking-lite
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
My Calendar – Accessible Event Manager my-calendar
NewsPlus Shortcodes newsplus-shortcodes
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
Ninja Forms – File Uploads ninja-forms-uploads
Ninja Forms – The Contact Form Builder That Grows With You ninja-forms
Novalnet Payment Gateway for WooCommerce woocommerce-novalnet-gateway
NOWPayments for WooCommerce – Crypto Payment Gateway nowpayments-for-woocommerce
OpenAI Chatbot for WordPress – Helper helper
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams ppv-live-webcams
pCloud WP Backup pcloud-wp-backup
Perfmatters perfmatters
Permalink Manager for WooCommerce permalink-manager-for-woocommerce
PixMagix – WordPress Image Editor pixmagix
Plugin for Google Analytics by IO technologies io-engagement-analytics
POS Entegratör – Gurmehub Ödeme Eklentisi pos-entegrator
Premium Addons for KingComposer premium-addons-for-kingcomposer
Printcart Web to Print Product Designer for WooCommerce printcart-integration
Private Content private-content
Product Addons and Product Options With Custom Fields – WowAddons product-addons
Product Video Gallery for Woocommerce product-video-gallery-slider-for-woocommerce
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Qi Blocks qi-blocks
Quads Ads Manager for Google AdSense quick-adsense-reloaded
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker quiz-master-next
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login custom-registration-form-builder-with-submission-manager
Request a Quote – Quote Forms for Any WordPress Site request-a-quote
Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations fb-reviews-widget
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema reviewx
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator feedzy-rss-feeds
RTMKit rometheme-for-elementor
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization metasync
Sendcloud Shipping sendcloud-connected-shipping
Shopify shopify-plugin
Shopping Cart & eCommerce Store wp-easycart
Shortcodes and extra features for Phlox theme auxin-elements
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization shortpixel-adaptive-images
Simple Link Directory Pro qc-simple-link-directory
Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management simple-urls
Simple User Avatar simple-user-avatar
Slider Revolution revslider
Slim SEO – A Fast & Automated SEO Plugin For WordPress slim-seo
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery sms-alert
Speaker speaker
SportsPress Pro sportspress-pro
Structured Content (JSON-LD) #wpsc structured-content
Struktur Core struktur-core
Surbma | Yoast SEO Breadcrumb Shortcode surbma-yoast-breadcrumb-shortcode
Survey Maker by AYS survey-maker
SysBasics Customize My Account for WooCommerce – Live My Account Customizer customize-my-account-for-woocommerce
Taskbuilder – Project Management & Task Management Tool With Kanban Board taskbuilder
Tax Exempt for WooCommerce woocommerce-tax-exempt-plugin
Team Members – Multi Language Supported Team Plugin team-showcase-supreme
TheGem Theme Elements thegem-elements-elementor
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More image-sizes
Timetics – Appointment Booking Calendar & Scheduling System timetics
TinyPNG – JPEG, PNG & WebP image compression tiny-compress-images
Tour Master – Tour Booking, Travel, Hotel tourmaster
Tutor LMS – eLearning and online course solution tutor
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Universal Clocks universal-clocks
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration wp-user-frontend
Video Gallery – YouTube Gallery, Playlist & Video Grid youtube-showcase
VikBooking Hotel Booking Engine & PMS vikbooking
Visualizer – Tables & Charts Manager with Built-in AI Generator visualizer
W3 Total Cache w3-total-cache
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments wallet-system-for-woocommerce
Webmention webmention
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot wedocs
WooCommerce Designer Pro wc-designer-pro
Woostify Sites Library woostify-sites-library
WP Database Backup – Unlimited Database & Files Backup by Backup for WP wp-database-backup
WP Debugging wp-debugging
WP Fast Total Search – The Power of Indexed Search fulltext-search
WP Google Review Slider wp-google-places-review-slider
WP Import Export Lite wp-import-export-lite
WP Inventory Manager wp-inventory-manager
WP Photo Album Plus wp-photo-album-plus
WP Review Slider Pro wp-review-slider-pro
WP-BusinessDirectory – Business directory plugin for WordPress wp-businessdirectory
WPAdverts – Classifieds Plugin wpadverts
WPBakery Page Builder Addons by Livemesh addons-for-visual-composer
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services chatbot
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables
WPeMatico RSS Feed Fetcher wpematico
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More wpforms-lite
WPIDE – File Manager & Code Editor wpide

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Aalto – Architecture and Interior Design WordPress Theme aalto
aqua aqua
Artale | Wedding Photography WordPress artale
Audrey – Fashion WordPress Theme audrey
Automotive Car Dealership Business WordPress Theme automotive
Billey – Creative Portfolio & Agency Elementor WordPress Theme billey
Brook – Agency Business Creative WordPress Theme brook
Corpkit – Business Consulting WordPress Theme corpkit
Dør – Modern Architecture and Interior Design Theme dor
EduMall – Professional LMS Education Center WordPress Theme edumall
Fascinate fascinate
Fitness Zone WordPress Theme fitnesszone
Flatsome flatsome
Flow flow
Kids Life | Children School WordPress kidslife
Kids Zone – Children WordPress Theme kidszone
Kitchor – Interior Design WordPress Theme kitchor
Leedo – Modern, Colorful & Creative Portfolio WordPress Theme leedo
Lighthouse | School for Kids with Disabilities & Special Needs WordPress Theme lighthouseschool
LMS – Education WordPress Theme lms
Martfury – Marketplace Mobile App Figma Template martfury
Motors – Car Dealer, Rental & Listing WordPress theme motors
NativeChurch NativeChurch
Nuss – Hotel Booking WordPress nuss
Overworld – eSports and Gaming WordPress Theme overworld
pearl pearl
Real Estate 7 WordPress realestate-7
SetSail – Travel Agency WordPress Theme setsail
SpaLab | Beauty Salon WordPress Theme spalab
Struktur – Creative Agency WordPress Theme struktur
TheFox | Responsive Multi-Purpose WordPress Theme thefox
Tonda – Elegant Shop WordPress Theme tonda
Trendy Travel WordPress trendytravel
unicamp unicamp
VW Food Corner vw-food-corner
VW Wedding vw-wedding
Werkstatt – Creative Portfolio WordPress Theme werkstatt
Woffice CRM woffice
Zakra zakra
Zegen – Church WordPress Theme zegen

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Blocksy Companion <= 2.1.46 – Unauthenticated Arbitrary File Upload via ‘blc-review-images[]’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-15158
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Blocksy Companion [blocksy-companion]

Researcher

More Details >

Blocksy Companion Pro <= 2.1.46 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57624
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Blocksy Companion Pro [blocksy-companion-pro]

Researcher

More Details >

Divi Form Builder <= 5.1.8 – Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via ‘acceptFileTypes’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-5524
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Divi Form Builder [divi-form-builder]

Researcher

More Details >

EventON – WordPress Virtual Event Calendar Plugin <= 5.0.11 – Unauthenticated Blind SQL Injection via Search Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-9711
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

EventON (Pro) – WordPress Virtual Event Calendar Plugin [eventON]

Researcher

More Details >

Private Content <= 9.9.2 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57692
Patch Status
Unpatched
Published
Jul 1, 2026

Affected Software

Private Content [private-content]

Researcher

More Details >

ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.5 – Unauthenticated Privilege Escalation via Email Overwrite

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12073
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]

Researcher

More Details >

SMS Alert <= 3.9.5 – Unauthenticated Privilege Escalation via Arbitrary Password Reset

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-11387
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researchers

More Details >

Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-9725
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Printcart Web to Print Product Designer for WooCommerce [printcart-integration]

Researcher

More Details >

WP-BusinessDirectory <= 4.0.1 – Unauthenticated Arbitrary File Deletion via Path Traversal via ‘_filename’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-6070
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

WP-BusinessDirectory – Business directory plugin for WordPress [wp-businessdirectory]

Researcher

More Details >

Dokan Pro <= 5.0.4 – Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12224
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

More Details >

LatePoint <= 5.6.3 – Authenticated (Custom+) Privilege Escalation to Administrator via ‘order[customer_id]’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-13228
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

RegistrationMagic <= 6.0.9.1 – Cross-Site Request Forgery to Privilege Escalation via ‘rmc_assign_user_role_action’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12158
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researchers

More Details >

Zegen – Church WordPress Theme <= 1.1.9 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-27419
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Zegen – Church WordPress Theme [zegen]

Researcher

More Details >

Audrey <= 1.5 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42382
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Audrey – Fashion WordPress Theme [audrey]

Researcher

More Details >

Embed Privacy <= 1.12.3 – Authenticated (Contributor+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57346
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Embed Privacy [embed-privacy]

Researcher

More Details >

Image Optimizer <= 1.7.4 – Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-5821
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Image Optimization – Compress Images and Convert to WebP or AVIF [image-optimization]

Researcher

More Details >

Lighthouse <= 1.2.12 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-58902
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Lighthouse | School for Kids with Disabilities & Special Needs WordPress Theme [lighthouseschool]

Researcher

More Details >

Novalnet Payment Gateway for WooCommerce <= 12.10.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57677
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Novalnet Payment Gateway for WooCommerce [woocommerce-novalnet-gateway]

Researcher

More Details >

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.4.8 – Authenticated (Performer+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57331
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]

Researcher

More Details >

Pearl – Corporate Business <= 3.4.10 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-27412
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

pearl [pearl]

Researcher

More Details >

TinyPNG <= 3.6.13 – Authenticated (Author+) Arbitrary File Deletion via ‘convert.path’ in ‘tiny_compress_images’ Post Meta

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-7311
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

TinyPNG – JPEG, PNG & WebP image compression [tiny-compress-images]

Researcher

More Details >

W3 Total Cache <= 2.9.4 – Unauthenticated Arbitrary Code Execution

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57623
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

More Details >

Export User Data <= 2.2.6 – Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field

8.0

CVSS Rating
8.0 (High)
CVE-ID

CVE-2026-12240
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Export User Data [export-user-data]

Researcher

More Details >

Aalto <= 1.8 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57788
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Aalto – Architecture and Interior Design WordPress Theme [aalto]

Researcher

More Details >

Aqua <= 5.1.2 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57789
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

aqua [aqua]

Researcher

More Details >

AR for WooCommerce <= 8.40 – Unauthenticated Path Traversal to Arbitrary File Read via ‘file’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-14352
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

AR for WooCommerce [ar-for-woocommerce]

Researcher

More Details >

AR for WordPress <= 8.40 – Unauthenticated Arbitrary File Read via ‘file’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-14327
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

AR for WordPress [ar-for-wordpress]

Researcher

More Details >

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.0 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-27060
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup [armember]

Researcher

More Details >

Billey <= 2.1.8 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57790
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Billey – Creative Portfolio & Agency Elementor WordPress Theme [billey]

Researcher

More Details >

BookingPress Appointment Booking Pro <= 5.7.1 – Unauthenticated SQL Injection via ‘store_service_date’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-11823
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

BookingPress Appointment Booking Pro [bookingpress-appointment-booking-pro]

Researcher

More Details >

Brook – Agency Business Creative WordPress Theme <= 2.9.0 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57791
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Brook – Agency Business Creative WordPress Theme [brook]

Researcher

More Details >

Dør – Modern Architecture and Interior Design Theme <= 2.4.1 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57792
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Dør – Modern Architecture and Interior Design Theme [dor]

Researcher

More Details >

Flow <= 1.8 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57793
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Flow [flow]

Researcher

More Details >

GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57679
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content [geeky-bot]

Researcher

More Details >

Golo Framework <= 1.7.3 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57794
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Golo Framework [golo-framework]

Researcher

More Details >

Kitchor <= 1.4.3 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57795
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Kitchor – Interior Design WordPress Theme [kitchor]

Researcher

More Details >

Leedo <= 3.0.0 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57796
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Leedo – Modern, Colorful & Creative Portfolio WordPress Theme [leedo]

Researcher

More Details >

NewsPlus Shortcodes <= 4.2.0 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57798
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

NewsPlus Shortcodes [newsplus-shortcodes]

Researcher

More Details >

Ninja Forms – File Uploads <= 3.3.29 – Unauthenticated Arbitrary File Read via File Upload Field ‘files[].data.file_path’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-13369
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Ninja Forms – File Uploads [ninja-forms-uploads]

Researcher

More Details >

Ninja Forms <= 3.14.1 – Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-1239
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms]

Researcher

More Details >

Nuss – Hotel Booking WordPress <= 1.3.6 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57799
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Nuss – Hotel Booking WordPress [nuss]

Researcher

More Details >

Overworld – eSports and Gaming WordPress Theme <= 1.5 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57800
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Overworld – eSports and Gaming WordPress Theme [overworld]

Researcher

More Details >

Perfmatters <= 2.6.4 – Unauthenticated Arbitrary File Read via ‘s’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-13251
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Perfmatters [perfmatters]

Researcher

More Details >

Request a Quote Form Plugin <= 2.5.5 – Unauthenticated Code Injection via ‘path’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-14249
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Request a Quote – Quote Forms for Any WordPress Site [request-a-quote]

Researcher

More Details >

SetSail – Travel Agency WordPress Theme <= 2.1 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57801
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

SetSail – Travel Agency WordPress Theme [setsail]

Researcher

More Details >

Shopify <= 1.0.0 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57748
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Shopify [shopify-plugin]

Researcher

More Details >

SportsPress Pro <= 2.7.29 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57749
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

SportsPress Pro [sportspress-pro]

Researcher

More Details >

Struktur – Creative Agency WordPress Theme <= 2.5.1 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57802
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Struktur – Creative Agency WordPress Theme [struktur]

Researcher

More Details >

Struktur Core <= 2.5.1 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57803
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Struktur Core [struktur-core]

Researcher

More Details >

TheGem Theme Elements <= 5.11.1 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57804
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

TheGem Theme Elements [thegem-elements-elementor]

Researcher

More Details >

Tonda <= 2.5 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57805
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Tonda – Elegant Shop WordPress Theme [tonda]

Researcher

More Details >

Tour Master – Tour Booking, Travel, Hotel <= 5.4.5 – Authenticated (Subscriber+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2025-69133
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Tour Master – Tour Booking, Travel, Hotel [tourmaster]

Researcher

More Details >

Video Gallery <= 4.0.3 – Authenticated (Subscriber+) Arbitrary Function Call via ‘path’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12923
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Video Gallery – YouTube Gallery, Playlist & Video Grid [youtube-showcase]

Researcher

More Details >

Visualizer <= 4.0.3 – Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-13468
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer]

Researcher

More Details >

Werkstatt – Creative Portfolio WordPress Theme <= 4.8.3 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-27414
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Werkstatt – Creative Portfolio WordPress Theme [werkstatt]

Researcher

More Details >

WP Fast Total Search – The Power of Indexed Search <= 1.80.280 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57683
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

WP Fast Total Search – The Power of Indexed Search [fulltext-search]

Researcher

More Details >

WP Review Slider Pro <= 12.7.2 – Unauthenticated SQL Injection via ‘notinstring’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-8441
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

Admin and Site Enhancements (ASE) Pro <= 8.8.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57625
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Admin and Site Enhancements (ASE) Pro [admin-site-enhancements-pro]

Researcher

More Details >

Ajax Load More – Filters <= 3.4.1 – Unauthenticated Stored Cross-Site Scripting via ‘taxonomy_include_children’ Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-8141
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Ajax Load More – Filters [ajax-load-more-filters]

Researcher

More Details >

Artale | Wedding Photography WordPress <= 2.2.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2025-69152
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Artale | Wedding Photography WordPress [artale]

Researcher

More Details >

BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57320
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net [woo-bulk-editor]

Researcher

More Details >

Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.22 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57326
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]

Researcher

More Details >

Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57344
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]

Researcher

More Details >

CodePeople Post Map for Google Maps <= 1.2.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57670
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

CodePeople Post Map for Google Maps [codepeople-post-map]

Researcher

More Details >

Comments <= 7.6.56 – Unauthenticated Stored Cross-Site Scripting via ‘Website’ Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-9148
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Comments – wpDiscuz [wpdiscuz]

Researcher

More Details >

Custom Payment Gateways for WooCommerce <= 2.1.0 – Unauthenticated Stored Cross-Site Scripting via ‘alg_wc_cpg_input_fields’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-7517
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Custom Payment Gateways for WooCommerce [custom-payment-gateways-woocommerce]

Researcher

More Details >

eCommerce Product Catalog Plugin for WordPress <= 3.5.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57360
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

eCommerce Product Catalog Plugin for WordPress [ecommerce-product-catalog]

Researcher

More Details >

Fitness Zone WordPress <= 5.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2025-69155
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Fitness Zone WordPress Theme [fitnesszone]

Researcher

More Details >

Five Star Business Profile and Schema <= 2.3.19 – Authenticated (Editor+) Arbitrary Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-27436
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Five Star Business Profile and Schema [business-profile]

Researcher

More Details >

HandL UTM Grabber / Tracker <= 2.9.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57351
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

HandL UTM Grabber / Tracker [handl-utm-grabber]

Researcher

More Details >

Internal Links Manager <= 3.0.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57345
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Internal Links Manager [seo-automated-link-building]

Researcher

More Details >

Kids Life | Children School WordPress <= 5.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-27402
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Kids Life | Children School WordPress [kidslife]

Researcher

More Details >

Kids Zone – Children WordPress <= 5.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2025-69156
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Kids Zone – Children WordPress Theme [kidszone]

Researcher

More Details >

Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages <= 1.5.3.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57337
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages [page-builder-add]

Researcher

More Details >

Modula – PRO <= 2.10.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57426
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Module PRO [modula]

Researcher

More Details >

MoreConvert Wishlist for WooCommerce <= 1.9.19 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57356
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

MoreConvert Wishlist for WooCommerce [smart-wishlist-for-more-convert]

Researcher

More Details >

NEX-Forms <= 9.2.2 – Unauthenticated Stored Cross-Site Scripting via ‘_name[]’ Array Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-12142
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

NEX-Forms <= 9.2.2 – Unauthenticated Stored Cross-Site Scripting via ‘real_val__’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13040
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57673
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

More Details >

Perfmatters <= 2.6.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57671
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Perfmatters [perfmatters]

Researcher

More Details >

Product Addons and Product Options With Custom Fields – WowAddons <= 1.6.14 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57686
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Product Addons and Product Options With Custom Fields – WowAddons [product-addons]

Researcher

More Details >

Real Estate 7 WordPress <= 3.5.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57343
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Real Estate 7 WordPress [realestate-7]

Researcher

More Details >

ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57359
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema [reviewx]

Researcher

More Details >

Simple Link Directory Pro <= 15.0.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57682
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Simple Link Directory Pro [qc-simple-link-directory]

Researcher

More Details >

Slider Revolution 7.0.0-7.0.16 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57678
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Slider Revolution [revslider]

Researcher

More Details >

SpaLab | Beauty Salon WordPress <= 6.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2025-69154
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

SpaLab | Beauty Salon WordPress Theme [spalab]

Researcher

More Details >

Survey Maker by AYS <= 5.2.2.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57361
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Survey Maker by AYS [survey-maker]

Researcher

More Details >

Timetics – Appointment Booking Calendar & Scheduling System <= 1.0.58 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57674
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Timetics – Appointment Booking Calendar & Scheduling System [timetics]

Researcher

More Details >

Webmention <= 5.8.0 – Unauthenticated Stored Cross-Site Scripting via MF2 ‘photo’/’url’ Author Properties

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-10513
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Webmention [webmention]

Researcher

More Details >

WP Database Backup <= 7.11 – Authenticated (Administrator+) OS Command Injection via ‘wp_db_exclude_table’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-9834
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

WP Database Backup – Unlimited Database & Files Backup by Backup for WP [wp-database-backup]

Researcher

More Details >

WP Debugging <= 2.12.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57350
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

WP Debugging [wp-debugging]

Researcher

More Details >

WP Photo Album Plus <= 9.2.02.004 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57675
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WPAdverts – Classifieds Plugin <= 2.3.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57366
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

More Details >

WPBot <= 8.4.9 – Unauthenticated Stored Cross-Site Scripting via ‘conversation’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13731
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

More Details >

wpDataTables (Premium) <= 6.5.1.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57672
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables]

Researcher

More Details >

WPeMatico RSS Feed Fetcher <= 2.8.17 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57349
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

More Details >

Corpkit – Business Consulting WordPress Theme <= 1.0.5 – Authenticated (Subscriber+) Sensitive Information Exopsure

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2025-69132
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Corpkit – Business Consulting WordPress Theme [corpkit]

Researcher

More Details >

Custom Field Template <= 2.7.8 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57687
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Custom Field Template [custom-field-template]

Researcher

More Details >

CWS SVGicons <= 1.5.5 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57787
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

cws-svgicons [cws-svgicons]

Researcher

More Details >

Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 – Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field ‘raw_value’

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-9145
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Database for Contact Form 7, WPforms, Elementor forms [contact-form-entries]

Researcher

More Details >

GD Rating System <= 3.7 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57771
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

GD Rating System [gd-rating-system]

Researcher

More Details >

Groundhogg <= 4.5.8 – Authenticated (Custom+) SQL Injection via ‘select’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-14029
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

iNET Webkit 1.2.4 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57752
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

iNET Webkit [inet-webkit]

Researcher

More Details >

LearnPress <= 4.3.9.1 – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via ‘userId’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-11988
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

MotoPress Appointment Booking <= 2.4.5 – Authenticated (Staff+) SQL Injection via ‘s’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13454
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

MotoPress Appointment Booking [motopress-appointment-lite]

Researcher

More Details >

PixMagix <= 1.7.2 – Authenticated (Author+) Path Traversal in ‘layers[].id’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-11367
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

PixMagix – WordPress Image Editor [pixmagix]

Researcher

More Details >

Shopping Cart & eCommerce Store <= 5.9.1 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57765
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Shopping Cart & eCommerce Store [wp-easycart]

Researcher

More Details >

Taskbuilder <= 5.0.8 – Authenticated (Subscriber+) SQL Injection via ‘task_search’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12110
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Taskbuilder – Project Management & Task Management Tool With Kanban Board [taskbuilder]

Researcher

More Details >

Taskbuilder <= 5.0.8 – Authenticated (Subscriber+) SQL Injection via ‘wppm_proj_filter’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12090
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Taskbuilder – Project Management & Task Management Tool With Kanban Board [taskbuilder]

Researcher

More Details >

Unicamp – University and College WordPress Theme <= 2.2.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2025-69094
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

unicamp [unicamp]

Researcher

More Details >

WP Inventory Manager <= 2.4.0 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57772
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

WP Inventory Manager [wp-inventory-manager]

Researcher

More Details >

Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.22 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57328
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]

Researcher

More Details >

CM Business Directory <= 1.5.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8892
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

CM Business Directory – Optimise and showcase local business [cm-business-directory]

Researcher

More Details >

Download Manager <= 3.3.60 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘no_data_msg’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13733
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Envision Page Builder – A collection of WordPress Gutenberg blocks & templates <= 0.22 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57780
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Envision Page Builder – A collection of WordPress Gutenberg blocks & templates [envision-page-builder]

Researcher

More Details >

Event Organiser <= 3.12.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2387
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Event Organiser [event-organiser]

Researcher

More Details >

FV Flowplayer Video Player <= 7.5.51.7212 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘video_player’ Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12135
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

FV Flowplayer Video Player [fv-wordpress-flowplayer]

Researcher

More Details >

GenerateBlocks <= 2.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block ‘linkMetaFieldType’ Dynamic Link Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9756
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

GenerateBlocks [generateblocks]

Researcher

More Details >

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.161 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57681
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

More Details >

GiveWP <= 4.16.0 – Authenticated (Author+) Stored Cross-Site Scripting via ‘block_id’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13246
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

GiveWP <= 4.16.1 – Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13704
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Insert Pages <= 3.11.4 – Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10089
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Insert Pages [insert-pages]

Researcher

More Details >

JetWidgets For Elementor <= 1.0.21 – Authenticated (Author+) Stored Cross-Site Scripting via Animated Box ‘animation_effect’ Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11380
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

JetWidgets For Elementor [jetwidgets-for-elementor]

Researcher

More Details >

JSON API User <= 4.1.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘content’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9626
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

JSON API User [json-api-user]

Researcher

5b840087cae0a13b411eb404ad102a47Yat

More Details >

Kali Forms <= 2.4.13 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘kaliforms_field_components’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9107
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

More Details >

LearnPress <= 4.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘class_wrapper_form’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12732
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researchers

More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.27 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57330
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

Mosaic Gallery – Advanced Gallery <= 1.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57755
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Mosaic Gallery – Advanced Gallery [mosaic-gallery-advanced-gallery]

Researcher

More Details >

Reviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘page_id’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12154
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations [fb-reviews-widget]

Researcher

More Details >

RSS Aggregator by Feedzy <= 5.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘aspectRatio’ Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13252
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]

Researcher

More Details >

RTMKit <= 2.0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget ‘Background Text’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8351
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

RTMKit [rometheme-for-elementor]

Researcher

More Details >

Shortcodes and extra features for Phlox theme <= 2.17.21 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57737
Patch Status
Unpatched
Published
Jul 1, 2026

Affected Software

Shortcodes and extra features for Phlox theme [auxin-elements]

Researcher

More Details >

ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57342
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization [shortpixel-adaptive-images]

Researcher

More Details >

Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management <= 151 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57762
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management [simple-urls]

Researcher

More Details >

Speaker <= 4.1.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57783
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Speaker [speaker]

Researcher

More Details >

Structured Content (JSON-LD) #wpsc <= 1.7.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57763
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Structured Content (JSON-LD) #wpsc [structured-content]

Researcher

More Details >

Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57764
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Surbma | Yoast SEO Breadcrumb Shortcode [surbma-yoast-breadcrumb-shortcode]

Researcher

More Details >

TheFox <= 3.9.70 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57684
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

TheFox | Responsive Multi-Purpose WordPress Theme [thefox]

Researcher

More Details >

Tutor LMS <= 3.9.13 – Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13443
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Ultimate Member <= 2.11.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8489
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘connectorWidth’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12734
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot [wedocs]

Researcher

More Details >

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘sectionTitleTag’ and ‘articleTitleTag’ Block Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12731
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot [wedocs]

Researcher

More Details >

WooCommerce Designer Pro <= 1.9.34 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57329
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

WooCommerce Designer Pro [wc-designer-pro]

Researcher

More Details >

WP Photo Album Plus <= 9.1.13.005 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘subtext’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10095
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WPBakery Page Builder Addons by Livemesh <= 3.9.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57754
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

WPBakery Page Builder Addons by Livemesh [addons-for-visual-composer]

Researcher

More Details >

Zakra <= 4.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4804
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Zakra [zakra]

Researcher

More Details >

ARforms <= 7.1.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57338
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

ARforms [arforms]

Researcher

More Details >

Automotive Car Dealership Business WordPress Theme <= 13.3.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-27426
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Automotive Car Dealership Business WordPress Theme [automotive]

Researcher

More Details >

Automotive Listings <= 18.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-27425
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Automotive Listings [automotive]

Researcher

More Details >

Link Whisper Free <= 0.9.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57333
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Link Whisper Free [link-whisper]

Researcher

More Details >

LMS <= 9.7 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-27404
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

LMS – Education WordPress Theme [lms]

Researcher

More Details >

NativeChurch <= 4.8.8.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-27408
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

NativeChurch [NativeChurch]

Researcher

More Details >

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.4 – Unauthenticated Server-Side Request Forgery

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57348
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

More Details >

Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization <= 2.6.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57357
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization [metasync]

Researcher

More Details >

SysBasics Customize My Account for WooCommerce – Live My Account Customizer <= 4.3.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57358
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

SysBasics Customize My Account for WooCommerce – Live My Account Customizer [customize-my-account-for-woocommerce]

Researcher

More Details >

Trendy Travel <= 6.7 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2025-69153
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Trendy Travel WordPress [trendytravel]

Researcher

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.12 – Reflected Cross-Site Scripting via ‘layoutstyle’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-12754
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

WP Google Review Slider <= 18.1 – Reflected Cross-Site Scripting via ‘place’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-13015
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

WP Google Review Slider [wp-google-places-review-slider]

Researcher

More Details >

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57362
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

More Details >

WP Import Export Lite <= 3.9.30 – Authenticated (Administrator+) Server-Side Request Forgery via ‘file_url’ Parameter

5.5

CVSS Rating
5.5 (Medium)
CVE-ID

CVE-2026-11397
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

CURCY <= 2.2.14 – Unauthenticated Arbitrary Shortcode Execution via ‘exchange’ Parameter

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-11778
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x [woo-multi-currency]

Researcher

More Details >

Academy LMS <= 3.8.1 – Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-5348
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Academy LMS [academy]

Researcher

More Details >

Advanced Booking & Appointment System – Webba Booking Calendar <= 6.4.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27409
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Advanced Booking & Appointment System – Webba Booking Calendar [webba-booking-lite]

Researcher

More Details >

ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57352
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce [woo-alidropship]

Researcher

More Details >

ApplyOnline – Application Form Builder and Manager <= 2.6.7.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57721
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

ApplyOnline – Application Form Builder and Manager [apply-online]

Researcher

More Details >

Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 – Unauthenticated Insecure Direct Object Reference via Predictable ‘edit_key’ / ‘appointmentkey’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9188
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Appointment Bookings for Zoom GoogleMeet and more – Wappointment [wappointment]

Researcher

More Details >

Booking calendar, Appointment Booking System <= 3.2.36 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57778
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Booking calendar, Appointment Booking System [booking-calendar]

Researcher

More Details >

Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.23 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57339
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]

Researcher

More Details >

Colissimo shipping methods for WooCommerce <= 2.9.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57341
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Colissimo shipping methods for WooCommerce [colissimo-shipping-methods-for-woocommerce]

Researcher

More Details >

Exclusive Addons for Elementor <= 2.7.9.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-59511
Patch Status
Patched
Published
Jul 5, 2026

Affected Software

Exclusive Addons for Elementor [exclusive-addons-for-elementor]

Researcher

More Details >

ez Form Calculator Premium <= 2.14.1.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57750
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

ez Form Calculator Premium [ez-form-calculator-premium]

Researcher

More Details >

Fascinate <= 1.1.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57779
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Fascinate [fascinate]

Researcher

More Details >

FormLayer <= 1.0.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-59519
Patch Status
Patched
Published
Jul 5, 2026

Affected Software

FormLayer [formlayer]

Researcher

More Details >

Japanized for WooCommerce <= 2.9.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57340
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Japanized for WooCommerce [woocommerce-for-japan]

Researcher

More Details >

JetFormBuilder <= 3.6.3 – Missing Authorization to Unauthenticated Sensitive Information Disclosure via ‘context’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-13459
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Kirki <= 6.0.11 – Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via ’emailBody’ and ’emailSubject’ Parameters

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12472
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researchers

More Details >

Kirki <= 6.0.11 – Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12122
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57753
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Kit (formerly ConvertKit) for WooCommerce [convertkit-for-woocommerce]

Researcher

More Details >

LatePoint <= 5.6.1 – Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11398
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

LatePoint <= 5.6.2 – Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via ‘service_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12657
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

MeetingHub – Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet <= 1.25.10 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57781
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

MeetingHub – Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet [meetinghub]

Researcher

More Details >

MotoPress Appointment Booking <= 2.4.4 – Unauthenticated Insecure Direct Object Reference to ‘payment_details.booking_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9180
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

MotoPress Appointment Booking [motopress-appointment-lite]

Researcher

More Details >

Motors – Car Dealer, Rental & Listing WordPress theme <= 5.6.80 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27433
Patch Status
Unpatched
Published
Jun 30, 2026

Affected Software

Motors – Car Dealer, Rental & Listing WordPress theme [motors]

Researcher

More Details >

My Calendar <= 3.7.14 – Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via ‘vcal’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11896
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

My Calendar – Accessible Event Manager [my-calendar]

Researchers

More Details >

Ninja Forms – File Uploads <= 3.3.29 – Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12557
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Ninja Forms – File Uploads [ninja-forms-uploads]

Researcher

More Details >

NOWPayments for WooCommerce – Crypto Payment Gateway <= 1.4.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39448
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

NOWPayments for WooCommerce – Crypto Payment Gateway [nowpayments-for-woocommerce]

Researcher

More Details >

OpenAI Chatbot for WordPress – Helper <= 1.1.4 – Missing Authorization to Unauthenticated Arbitrary Content Deletion

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-69134
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

OpenAI Chatbot for WordPress – Helper [helper]

Researcher

More Details >

POS Entegratör – Gurmehub Ödeme Eklentisi <= 3.7.103 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57688
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

POS Entegratör – Gurmehub Ödeme Eklentisi [pos-entegrator]

Researcher

More Details >

Premium Addons for KingComposer <= 1.1.1 – Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via ‘add_custom_sidebar’ and ‘remove_custom_sidebar’ AJAX actions

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12349
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Premium Addons for KingComposer [premium-addons-for-kingcomposer]

Researcher

More Details >

Sendcloud Shipping <= 1.0.31 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57760
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Sendcloud Shipping [sendcloud-connected-shipping]

Researcher

More Details >

Universal Clocks <= 1.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57782
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Universal Clocks [universal-clocks]

Researcher

More Details >

User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration <= 4.3.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57334
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration [wp-user-frontend]

Researcher(s): Unknown

More Details >

VW Food Corner <= 1.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57774
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

VW Food Corner [vw-food-corner]

Researcher

More Details >

VW Wedding <= 1.3.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57776
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

VW Wedding [vw-wedding]

Researcher

More Details >

Woffice CRM <= 5.4.31 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27435
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Woffice CRM [woffice]

Researcher

More Details >

Woostify Sites Library <= 1.6.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-66076
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Woostify Sites Library [woostify-sites-library]

Researcher

More Details >

WPForms <= 1.10.2 – Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12127
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]

Researcher

More Details >

Advanced Shipment Tracking for WooCommerce <= 4.0 – Authenticated (Shop manager+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-57773
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Advanced Shipment Tracking for WooCommerce [woo-advanced-shipment-tracking]

Researcher

More Details >

Cookie Banner for GDPR / CCPA <= 4.3.5 – Authenticated (Administrator+) SQL Injection via ‘s’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-12920
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent [gdpr-cookie-consent]

Researcher

More Details >

Houzez Property Feed <= 2.5.46 – Authenticated (Administrator+) SQL Injection via ‘orderby’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-13357
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Houzez Property Feed [houzez-property-feed]

Researcher

More Details >

Editorial Rating <= 4.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘Link URL’ Field

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12560
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Editorial Rating – Product Review & Rating System [editorial-rating]

Researcher

More Details >

Enable Media Replace <= 4.2.1 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-57722
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Enable Media Replace [enable-media-replace]

Researcher

More Details >

Product Video Gallery for Woocommerce <= 1.5.1.8 – Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-10104
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Product Video Gallery for Woocommerce [product-video-gallery-slider-for-woocommerce]

Researcher

More Details >

Team Members <= 8.7 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘custom_css’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12114
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Team Members – Multi Language Supported Team Plugin [team-showcase-supreme]

Researcher

More Details >

Ad Inserter <= 2.8.16 – Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via ‘data’ Shortcode Attribute

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11900
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

Advanced Contact form 7 DB <= 2.0.9 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57669
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Advanced Contact form 7 DB [advanced-cf7-db]

Researcher

More Details >

Appointment Booking Calendar <= 1.4.02 – Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12113
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Appointment Booking Calendar [appointment-booking-calendar]

Researcher

More Details >

Booked – Appointment Booking for WordPress <= 3.0.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57747
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Booked – Appointment Booking for WordPress [booked]

Researcher

More Details >

Booked – Appointment Booking for WordPress <= 3.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57746
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Booked – Appointment Booking for WordPress [booked]

Researcher

More Details >

Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57355
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]

Researcher

More Details >

CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor <= 3.0.16 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-59520
Patch Status
Patched
Published
Jul 5, 2026

Affected Software

CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor [mihdan-index-now]

Researcher

More Details >

EduMall – Professional LMS Education Center WordPress Theme <= 4.5.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57797
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

EduMall – Professional LMS Education Center WordPress Theme [edumall]

Researcher

More Details >

Email Subscribers & Newsletters <= 5.9.27 – Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11592
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress [email-subscribers]

Researcher

More Details >

Envo’s Templates & Widgets for Elementor and WooCommerce <= 1.4.26 – Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget ‘templates’ Setting

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11600
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Envo’s Templates & Widgets for Elementor and WooCommerce [envo-elementor-for-woocommerce]

Researchers

More Details >

Flatsome <= 3.20.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57730
Patch Status
Unpatched
Published
Jul 1, 2026

Affected Software

Flatsome [flatsome]

Researcher

More Details >

Flatsome <= 3.20.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57731
Patch Status
Unpatched
Published
Jul 1, 2026

Affected Software

Flatsome [flatsome]

Researcher

More Details >

GiveWP <= 4.15.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11981
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Heateor Social Login WordPress <= 1.1.39 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57751
Patch Status
Unpatched
Published
Jul 1, 2026

Affected Software

Heateor Social Login WordPress [heateor-social-login]

Researcher

More Details >

HubSpot All-In-One Marketing – Forms, Popups, Live Chat <= 11.3.56 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57736
Patch Status
Unpatched
Published
Jul 1, 2026

Affected Software

HubSpot All-In-One Marketing – Forms, Popups, Live Chat [leadin]

Researcher

More Details >

JoomSport <= 5.7.8 – Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12134
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

JoomSport – for Sports: Team & League, Football, Hockey & more [joomsport-sports-league-results-management]

Researchers

More Details >

JoomSport <= 5.7.8 – Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12133
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

JoomSport – for Sports: Team & League, Football, Hockey & more [joomsport-sports-league-results-management]

Researchers

More Details >

Kadence Blocks <= 3.7.7 – Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via ‘post_path’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12904
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

More Details >

Kadence Blocks <= 3.7.7 – Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12902
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

More Details >

Link Whisper Premium <= 2.9.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57353
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

Link Whisper Premium [link-whisper-premium]

Researcher

More Details >

MainWP Dashboard: Self-hosted WordPress Management for Agencies <= 6.1.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57327
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

MainWP Dashboard: Self-hosted WordPress Management for Agencies [mainwp]

Researcher

More Details >

Martfury – WooCommerce Marketplace WordPress <= 3.2.8 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57685
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Martfury – Marketplace Mobile App Figma Template [martfury]

Researcher

More Details >

MotoPress Hotel Booking <= 6.0.3 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57347
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

MotoPress Hotel Booking [motopress-hotel-booking-lite]

Researcher

More Details >

Motors <= 1.4.111 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via ‘stm_mark_as_sold_car’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12435
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

pCloud WP Backup <= 2.0.4 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57757
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

pCloud WP Backup [pcloud-wp-backup]

Researcher

More Details >

Permalink Manager for WooCommerce <= 1.0.8.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57758
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

Permalink Manager for WooCommerce [permalink-manager-for-woocommerce]

Researcher

More Details >

Plugin for Google Analytics by IO technologies <= 1.1 – Cross-Site Request Forgery via ‘ga_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8944
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Plugin for Google Analytics by IO technologies [io-engagement-analytics]

Researcher

More Details >

ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.8 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57759
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]

Researcher

More Details >

Qi Blocks <= 1.4.9 – Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via ‘page_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10096
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Qi Blocks [qi-blocks]

Researcher

More Details >

Quads Ads Manager for Google AdSense <= 3.0.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57335
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Quads Ads Manager for Google AdSense [quick-adsense-reloaded]

Researcher

More Details >

Quiz and Survey Master (QSM) <= 11.1.4 – Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9230
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker [quiz-master-next]

Researcher

More Details >

RTMKit <= 2.0.7 – Authenticated (Contributor+) Limited Local File Inclusion via ‘template’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-5137
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

RTMKit [rometheme-for-elementor]

Researcher

More Details >

Simple User Avatar <= 4.9 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57676
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Simple User Avatar [simple-user-avatar]

Researcher

More Details >

Slim SEO <= 4.9.8 – Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via ‘object.ID’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12408
Patch Status
Patched
Published
Jun 30, 2026

Affected Software

Slim SEO – A Fast & Automated SEO Plugin For WordPress [slim-seo]

Researcher

More Details >

Tax Exempt for WooCommerce <= 1.9.3 – Authenticated (Customer+) Path Traversal

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49779
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Tax Exempt for WooCommerce [woocommerce-tax-exempt-plugin]

Researcher

More Details >

ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More <= 6.3.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57720
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More [image-sizes]

Researcher

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.12 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57723
Patch Status
Patched
Published
Jul 1, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57332
Patch Status
Patched
Published
Jun 29, 2026

Affected Software

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]

Researcher

More Details >

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 – Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12729
Patch Status
Patched
Published
Jul 2, 2026

Affected Software

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot [wedocs]

Researcher

More Details >

Werkstatt – Creative Portfolio WordPress Theme <= 4.7.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57690
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Werkstatt – Creative Portfolio WordPress Theme [werkstatt]

Researcher

More Details >

Werkstatt – Creative Portfolio WordPress Theme <= 4.7.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57689
Patch Status
Unpatched
Published
Jun 29, 2026

Affected Software

Werkstatt – Creative Portfolio WordPress Theme [werkstatt]

Researcher

More Details >

WPIDE – File Manager & Code Editor <= 3.5.6 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57766
Patch Status
Unpatched
Published
Jul 2, 2026

Affected Software

WPIDE – File Manager & Code Editor [wpide]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 29, 2026 to July 5, 2026) appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (June 22, 2026 to June 28, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-22-2026-to-june-28-2026/ Thu, 02 Jul 2026 18:38:36 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-22-2026-to-june-28-2026/ Last week, there were 199 vulnerabilities disclosed in 169 WordPress Plugins and 9 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 111 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 148
Unpatched 51

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 143
High Severity 49
Critical Severity 6

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 53
Missing Authorization 52
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 29
Cross-Site Request Forgery (CSRF) 15
Exposure of Sensitive Information to an Unauthorized Actor 9
Authorization Bypass Through User-Controlled Key 8
Deserialization of Untrusted Data 6
Server-Side Request Forgery (SSRF) 5
Unrestricted Upload of File with Dangerous Type 5
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
Improper Control of Generation of Code (‘Code Injection’) 3
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 3
Incorrect Privilege Assignment 3
Weak Password Recovery Mechanism for Forgotten Password 2
External Control of File Name or Path 1
Improper Privilege Management 1
Insufficient Verification of Data Authenticity 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

14

11

6

6

6

5

5

5

5

4

4

4

4

3

3

3

3

3

2

2

2

2

2

2

2

2

2
f53fb061b2b39c3b94e35c3f1ba9c31a
lb

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
b1c4c306fad16439d9178a0d349f0c40
L4m

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
24liveblog – live blog tool 24liveblog
Abandoned Cart Lite for WooCommerce woocommerce-abandoned-cart
AdRotate Banner Manager adrotate
Advance Nav Menu Manager advance-nav-menu-manager
Advance Product Search- Voice & Ajax Search for WooCommerce th-advance-product-search
Advanced Contact Form 7 – Compact DB advanced-contact-form-7-compact-db
Advanced Order Export For WooCommerce woo-order-export-lite
Affiliates Manager affiliates-manager
AI Share & Summarize ai-share-summarize
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments
ARforms arforms
Assistio assistio
Auros Core auros-core
Avalon23 Products Filter for WooCommerce avalon23-products-filter-for-woocommerce
BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection bitfire
Block for Mailchimp – Add Email Subscription Forms and Collect Leads block-for-mailchimp
Blocksy Companion Pro blocksy-companion-pro
Blog2Social: Social Media Auto Post & Scheduler blog2social
Blue Captcha blue-captcha
BNE Testimonials bne-testimonials
Book a Room Event Calendar book-a-room-event-calendar
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment booking-and-rental-manager-for-woocommerce
BookPro – Appointment Booking WordPress Plugin ovabookpro
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools woocommerce-jetpack
Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder
BuddyBoss Platform buddyboss-platform
Bulk SEO Image bulk-seo-image
Child Theme Wizard child-theme-wizard
Cincopa video and media plug-in video-playlist-and-gallery-plugin
ClearSale Total clearsale-total
CodePeople Post Map for Google Maps codepeople-post-map
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery
Cornerstone cornerstone
CorvusPay WooCommerce Payment Gateway corvuspay-woocommerce-integration
Customer Reviews for WooCommerce customer-reviews-woocommerce
Devs Accounting – Simple Accounting and Invoicing Solution devs-accounting
Dokan Pro dokan-pro
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy dokan-lite
Donation Thermometer donation-thermometer
Eagle Booking eagle-booking
Elementor Website Builder – more than just a page builder elementor
Email JavaScript Cloak email-javascript-cloaker
Email Marketing for WooCommerce by Omnisend omnisend-connect
EntreDroppers entredropper
EventPrime – Events Calendar, Bookings and Tickets eventprime-event-calendar-management
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI everest-forms
Exclusive Addons for Elementor exclusive-addons-for-elementor
Featured Image featured-image
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution fluent-booking
Forget About Shortcode Buttons forget-about-shortcode-buttons
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
FOX – Currency Switcher Professional for WooCommerce woocommerce-currency-switcher
Frisbii Pay reepay-checkout-gateway
Frontend File Manager Plugin nmedia-user-file-uploader
FunnelKit Payment Gateway for Stripe WooCommerce funnelkit-stripe-woo-payment-gateway
FunnelKit – Funnel Builder for WooCommerce Checkout funnel-builder
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress gallery-plugin
Generate Security.txt generate-security-txt
GetGenie – AI Content Writer with Keyword Research & SEO Tracking getgenie
Ghost Kit – Page Builder Blocks, Motion Effects & Extensions ghostkit
GIFT4U – Gift Cards All in One for Woo gift4u-gift-cards-all-in-one-for-woo
Gmail SMTP gmail-smtp
Goya Core goya-core
Gravity Bookings gf-bookings-premium
GravityView gravityview
Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns essential-blocks
Gutenverse Form – Contact Form Builder, Block Form & Booking Form gutenverse-form
Gutenverse – WordPress Blocks, Page Builder & Site Editor gutenverse
HD Quiz hd-quiz
Hester Core hester-core
HTML5 Video Player – Embed and Play Videos in Custom Player html5-video-player
Image Carousel image-carousel
Image Sizes on Demand image-sizes-on-demand
Infility Global infility-global
Interactive Content – H5P h5p
Invoice Generator invoice-creator
Ivory Search – WordPress Search Plugin add-search-to-menu
JetEngine jet-engine
JetSmartFilters jet-smart-filters
JS Help Desk – AI-Powered Support & Ticketing System js-support-ticket
Kargo Takip kargo-takip
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Library Management System library-management-system
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator live-copy-paste
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid magazine-blocks
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites mainwp-child
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MaxButtons – Create buttons maxbuttons
MIR blocks and shortcodes mir-blocks-and-shortcodes
MotorDesk motordesk
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
MP Customize Login Page mp-customize-login-page
Nelio Content – Editorial Calendar & Social Media Auto-Posting nelio-content
Newsletters newsletters-lite
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
OMGF Pro host-google-fonts-pro
Osiris Signature Banner osiris-signature-banner
Page Builder by SiteOrigin siteorigin-panels
Paid Memberships Pro – Add Member From Admin pmpro-add-member-admin
Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More panorama
Payment Gateway Based Fees and Discounts for WooCommerce checkout-fees-for-woocommerce
Paytium: Mollie payment forms & donations paytium
Perfmatters perfmatters
Pie Register – User Registration, Profiles & Content Restriction pie-register
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups ays-popup-box
Post Duplicator post-duplicator
Post Snippets – Custom WordPress Code Snippets Customizer post-snippets
PPOM – Product Addons & Custom Fields for WooCommerce woocommerce-product-addon
PPWP – Password Protect Pages password-protect-page
Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes
Product Specifications for Woocommerce product-specifications
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Quform – WordPress Form Builder quform
Quick Interest Slider quick-interest-slider
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker quiz-master-next
Quotes llama quotes-llama
Recipe Cards For Your Food Blog from Zip Recipes zip-recipes
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login custom-registration-form-builder-with-submission-manager
RentMy Real-Time Rental Management Plugin rentmy-online-rental-shop
Responsive Lightbox & Gallery responsive-lightbox
Restaurant Menu and Food Ordering mp-restaurant-menu
Reviews and Rating – Docplanner reviews-and-rating-docplanner
SearchPlus searchplus
Secufor_OAuth wpoauth
SeedProd Pro seedprod-coming-soon-pro-5
SEOPress PRO wp-seopress-pro
Shoppable Images (Lookbook) for WooCommerce mabel-shoppable-images-lite
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization shortpixel-adaptive-images
SignUp & SignIn signup-signin
Simple Basic Contact Form simple-basic-contact-form
Site Kit by Google – Analytics, Search Console, AdSense, Speed google-site-kit
Site Reviews site-reviews
SiteGround Email Marketing siteground-email-marketing
Slim SEO – A Fast & Automated SEO Plugin For WordPress slim-seo
StatCounter – Free Real Time Visitor Stats official-statcounter-plugin-for-wordpress
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions wp-full-stripe-free
Subscriptions for WooCommerce subscriptions-for-woocommerce
Surbma | Infusionsoft Shortcode surbma-infusionsoft-shortcode
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments surecart
TablePress – Tables in WordPress made easy tablepress
TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder templatespare
Toolset Forms cred-frontend-editor
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin tourfic
Transbank Webpay transbank-webpay-plus-rest
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Uncanny Automator Pro uncanny-automator-pro
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin uncanny-automator
URL Preview link-preview
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration
utm.codes utm-dot-codes
WCBoost – Products Compare wcboost-products-compare
Welcome Software Publishing newscred-publishing
weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce wemail
WhatsOrder – Instant Checkout for WooCommerce whatsorder-instant-checkout-for-woocommerce
WordPress Automatic Plugin wp-automatic
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets wp-all-import
WP Forms Connector wp-forms-connector
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website wp-job-portal
WP Latest Posts wp-latest-posts
WP Meta SEO wp-meta-seo
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars wp-post-author
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System wp-cafe
WPComplete wpcomplete
wpForo Forum wpforo
Xpro Addons — 140+ Widgets for Elementor xpro-elementor-addons
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 pgall-for-woocommerce

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
ListingPro – WordPress Directory & Listing Theme listingpro
NanoMag – Responsive WordPress Magazine Theme nanomag
Neve PRO neve-pro-addon
Real Estate 7 WordPress realestate-7
RH – Real Estate WordPress Theme realhomes
Spexo spexo
splash splash
Travel Booking travel-booking
Woodmart woodmart

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Dokan Pro <= 5.0.4 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-56033
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

More Details >

Invoice Generator <= 1.0.0 – Unauthenticated Account Takeover via Weak Password Reset Validation via ‘reset_user_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12416
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Invoice Generator [invoice-creator]

Researcher

More Details >

Invoice Generator <= 1.0.0 – Unauthenticated Privilege Escalation via Account Takeover via ‘user_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12415
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Invoice Generator [invoice-creator]

Researcher

More Details >

OMGF Pro <= 5.2.6 – Unauthenticated Arbitrary File Upload via @import URL Reflection

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57700
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

OMGF Pro [host-google-fonts-pro]

Researchers

More Details >

Paytium: Mollie payment forms & donations <= 5.0.2 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-56030
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Paytium: Mollie payment forms & donations [paytium]

Researcher

More Details >

SignUp & SignIn <= 1.0.0 – Unauthenticated Privilege Escalation via Weak Password Reset Validation via ‘reset_activation_code’ Leading to Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12417
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

SignUp & SignIn [signup-signin]

Researcher

More Details >

AdRotate Banner Manager <= 5.17.7 – Authenticated (Contributor+) PHP Code Injection via ‘banner’ Shortcode Attribute

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12242
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

AdRotate Banner Manager [adrotate]

Researcher

More Details >

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 – Authenticated (Customer+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56027
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]

Researcher

More Details >

Frisbii Pay <= 1.8.2 – Authenticated (Contributor+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56038
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Frisbii Pay [reepay-checkout-gateway]

Researcher

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 – Authenticated (Subscriber+) Arbitrary File Deletion

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56054
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

More Details >

Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.19 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56049
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Post Snippets – Custom WordPress Code Snippets Customizer [post-snippets]

Researcher

More Details >

Quform – WordPress Form Builder <= 2.23.0 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56058
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Quform – WordPress Form Builder [quform]

Researcher

More Details >

Ultimate Member <= 2.11.4 – Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-7761
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

Welcome Software Publishing <= 0.0.31 – Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via ‘nc.setOption’ XML-RPC Method

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-4297
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Welcome Software Publishing [newscred-publishing]

Researcher

More Details >

Frontend File Manager Plugin <= 23.6 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-8095
Patch Status
Unpatched
Published
Jun 27, 2026

Affected Software

Frontend File Manager Plugin [nmedia-user-file-uploader]

Researcher

More Details >

Interactive Content – H5P <= 1.17.7 – Authenticated (Contributor+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57321
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Interactive Content – H5P [h5p]

Researcher

More Details >

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.1.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-56031
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin [uncanny-automator]

Researcher

More Details >

Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56070
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Advance Product Search- Voice & Ajax Search for WooCommerce [th-advance-product-search]

Researcher

More Details >

BuddyBoss Platform <= 3.0.4 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56032
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

BuddyBoss Platform [buddyboss-platform]

Researcher

More Details >

ClearSale Total <= 3.4.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-8705
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

ClearSale Total [clearsale-total]

Researcher

More Details >

Dokan Pro <= 5.0.4 – Unauthenticated SQL Injection via ‘latitude’ and ‘longitude’ Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12077
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

f53fb061b2b39c3b94e35c3f1ba9c31alb

More Details >

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56053
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]

Researcher

More Details >

Goya Core < 1.0.9.4 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2025-68064
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Goya Core [goya-core]

Researcher

More Details >

JetEngine <= 3.8.10.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56068
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetSmartFilters <= 3.8.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56067
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

JetSmartFilters [jet-smart-filters]

Researcher

More Details >

Library Management System <= 3.5.7 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56034
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Library Management System [library-management-system]

Researcher

More Details >

Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More <= 1.6.1 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57647
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More [panorama]

Researcher

More Details >

Post Duplicator < 3.0.15 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-10749
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Post Duplicator [post-duplicator]

Researcher

More Details >

Quotes llama <= 3.1.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56062
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Quotes llama [quotes-llama]

Researcher

More Details >

RH – Real Estate WordPress Theme <= 4.5.3 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56055
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

RH – Real Estate WordPress Theme [realhomes]

Researcher

More Details >

Splash – Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2025-68063
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

splash [splash]

Researcher

More Details >

Tourfic <= 2.22.7 – Unauthenticated SQL Injection via ‘post_id’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12937
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin [tourfic]

Researcher

More Details >

Uncanny Automator Pro <= 7.3.0.6 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56057
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Uncanny Automator Pro [uncanny-automator-pro]

Researcher

More Details >

WP Forms Connector <= 1.8 – Missing Authorization to Unauthenticated Information Exposure via ‘user/list’ REST Endpoint

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9178
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Forms Connector [wp-forms-connector]

Researcher

More Details >

WP Forms Connector <= 1.8 – Unauthenticated SQL Injection via ‘order’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9179
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Forms Connector [wp-forms-connector]

Researcher

More Details >

워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.5.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56036
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce]

Researcher

More Details >

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57317
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]

Researcher

More Details >

ARForms <= 7.1.3 – Unauthenticated Stored Cross-Site Scripting via ‘value’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-3652
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

ARforms [arforms]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 8.9.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56044
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Cincopa video and media plug-in <= 1.163 – Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-10092
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Cincopa video and media plug-in [video-playlist-and-gallery-plugin]

Researcher

More Details >

Customer Reviews for WooCommerce <= 5.110.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56043
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Customer Reviews for WooCommerce [customer-reviews-woocommerce]

Researcher

More Details >

Email JavaScript Cloak <= 1.03 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-10091
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Email JavaScript Cloak [email-javascript-cloaker]

Researcher

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56071
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

FOX – Currency Switcher Professional for WooCommerce <= 1.4.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57319
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

FOX – Currency Switcher Professional for WooCommerce [woocommerce-currency-switcher]

Researcher

More Details >

Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 2.4.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56040
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Gutenverse Form – Contact Form Builder, Block Form & Booking Form [gutenverse-form]

Researcher

More Details >

Kargo Takip <= 1.2 – Unauthenticated Server-Side Request Forgery via ‘api_url’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-12095
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Kargo Takip [kargo-takip]

Researcher

More Details >

NanoMag <= 1.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57325
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

NanoMag – Responsive WordPress Magazine Theme [nanomag]

Researcher

More Details >

Responsive Lightbox & Gallery <= 2.7.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56041
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Responsive Lightbox & Gallery [responsive-lightbox]

Researcher

More Details >

Simple Basic Contact Form <= 20250114 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-8172
Patch Status
Unpatched
Published
Jun 25, 2026

Affected Software

Simple Basic Contact Form [simple-basic-contact-form]

Researcher

More Details >

TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.0 – Authenticated (Admin+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57658
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder [templatespare]

Researcher

More Details >

Transbank Webpay < 1.14.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-6858
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

Transbank Webpay [transbank-webpay-plus-rest]

Researcher

More Details >

URL Preview <= 1.0 – Unauthenticated Server-Side Request Forgery via ‘url’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-12100
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

URL Preview [link-preview]

Researcher

More Details >

Woodmart <= 8.5.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56072
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Woodmart [woodmart]

Researcher

More Details >

WordPress Automatic Plugin < 3.135.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56045
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

WordPress Automatic Plugin [wp-automatic]

Researcher

More Details >

WP Meta SEO <= 4.5.18 – Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-9643
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Meta SEO [wp-meta-seo]

Researcher

More Details >

Auros Core <= 5.3.1 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2025-64637
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Auros Core [auros-core]

Researcher

More Details >

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57662
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

More Details >

Dokan Pro <= 5.0.4 – Authenticated (Subscriber+) SQL Injection via ‘orderby’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12079
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

f53fb061b2b39c3b94e35c3f1ba9c31alb

More Details >

Frisbii Pay <= 1.8.9 – Missing Authorization to Authenticated (Subscriber+) Payment Token Modification

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-3462
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Frisbii Pay [reepay-checkout-gateway]

Researcher

More Details >

Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.8 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57642
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress [gallery-plugin]

Researcher

More Details >

Gravity Forms Booking <= 2.7.1 – Authenticated (Subscriber+) Time-Based SQL Injection via ‘staff_id’

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-2508
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Gravity Bookings [gf-bookings-premium]

Researcher

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 – Authenticated (Sales representative+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57667
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Groundhogg <= 4.5.4 – Authenticated (Custom+) SQL Injection via ‘after’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13226
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Groundhogg <= 4.5.5 – Authenticated (Marketer+) SQL Injection via ‘search’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13331
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researchers

More Details >

Groundhogg <= 4.5.5 – Authenticated (Sales Rep+) SQL Injection via ‘query[select]’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13333
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researchers

More Details >

Infility Global < 2.15.19 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-8163
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Infility Global [infility-global]

Researcher

More Details >

Recipe Cards For Your Food Blog from Zip Recipes <= 8.2.7 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57663
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Recipe Cards For Your Food Blog from Zip Recipes [zip-recipes]

Researcher

More Details >

Restaurant Menu and Food Ordering <= 2.4.10 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57644
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Restaurant Menu and Food Ordering [mp-restaurant-menu]

Researcher

More Details >

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-56064
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin [tourfic]

Researcher

More Details >

User Registration & Membership <= 5.2.0 – Missing Authorization to Unauthenticated Payment Bypass

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-1869
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57653
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website [wp-job-portal]

Researcher

More Details >

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57643
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]

Researcher

More Details >

wpForo Forum <= 3.0.9 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57636
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

Advanced Order Export For WooCommerce <= 4.0.9 – Authenticated (Customer+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56042
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Advanced Order Export For WooCommerce [woo-order-export-lite]

Researcher

More Details >

AI Share & Summarize < 2.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10531
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

AI Share & Summarize [ai-share-summarize]

Researcher

More Details >

Avalon23 Products Filter for WooCommerce <= 1.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8865
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Avalon23 Products Filter for WooCommerce [avalon23-products-filter-for-woocommerce]

Researcher

More Details >

BNE Testimonials <= 2.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-68075
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

BNE Testimonials [bne-testimonials]

Researcher

More Details >

CodePeople Post Map for Google Maps <= 1.2.6 – Authenticated (Contributor +) Stored Cross-Site Scripting via ‘cpm_point’ Post Meta

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13335
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

CodePeople Post Map for Google Maps [codepeople-post-map]

Researchers

More Details >

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 – Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11783
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

Exclusive Addons for Elementor <= 2.7.9.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57620
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Exclusive Addons for Elementor [exclusive-addons-for-elementor]

Researcher

More Details >

Featured Image <= 2.1 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57431
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Featured Image [featured-image]

Researcher

More Details >

Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57638
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution [fluent-booking]

Researcher

More Details >

Frontend File Manager Plugin <= 23.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8378
Patch Status
Unpatched
Published
Jun 25, 2026

Affected Software

Frontend File Manager Plugin [nmedia-user-file-uploader]

Researcher

More Details >

Ghost Kit – Page Builder Blocks, Motion Effects & Extensions <= 3.6.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57651
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Ghost Kit – Page Builder Blocks, Motion Effects & Extensions [ghostkit]

Researcher

More Details >

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘configurablePrefix’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10833
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks]

Researcher

More Details >

Hester Core <= 1.1.8 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57656
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Hester Core [hester-core]

Researcher

More Details >

Image Carousel <= 1.0.0.41 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-68074
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Image Carousel [image-carousel]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57627
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

ListingPro – WordPress Directory & Listing Theme <= 2.9.11 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56046
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

ListingPro – WordPress Directory & Listing Theme [listingpro]

Researcher

More Details >

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.8.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57650
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks]

Researcher

More Details >

MIR blocks and shortcodes <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8896
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

MIR blocks and shortcodes [mir-blocks-and-shortcodes]

Researcher

More Details >

Neve PRO <= 3.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57618
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Neve PRO [neve-pro-addon]

Researcher

More Details >

Page Builder by SiteOrigin <= 2.34.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13295
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Page Builder by SiteOrigin [siteorigin-panels]

Researcher

More Details >

ProfileGrid <= 5.9.9.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4610
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]

Researcher

More Details >

SeedProd Pro < 6.19.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57617
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

SeedProd Pro [seedprod-coming-soon-pro-5]

Researcher

More Details >

StatCounter – Free Real Time Visitor Stats <= 2.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57629
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

StatCounter – Free Real Time Visitor Stats [official-statcounter-plugin-for-wordpress]

Researcher

More Details >

Surbma | Infusionsoft Shortcode <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11597
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Surbma | Infusionsoft Shortcode [surbma-infusionsoft-shortcode]

Researcher

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.2.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57313
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

More Details >

utm.codes <= 1.9.0 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56026
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

utm.codes [utm-dot-codes]

Researcher

More Details >

WP Latest Posts <= 5.0.11 – Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9620
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Latest Posts [wp-latest-posts]

Researcher

More Details >

WP Meta SEO <= 4.5.18 – Authenticated (Contributor+) Server-Side Request Forgery via ‘new_link’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11370
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Meta SEO [wp-meta-seo]

Researcher

More Details >

Xpro Addons <= 1.7.2 – Authenticated (Author+) Stored Cross-Site Scripting via ‘custom_attributes’ Parameter of Multiple Widgets

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11614
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]

Researcher

More Details >

EntreDroppers <= 1.1.2 – Reflected Cross-Site Scripting via PHP_SELF Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8628
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

EntreDroppers [entredropper]

Researcher

More Details >

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.4.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57312
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms]

Researcher

More Details >

Image Sizes on Demand <= 1.3 – Reflected Cross-Site Scripting via PHP_SELF Server Variable

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8622
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Image Sizes on Demand [image-sizes-on-demand]

Researcher

More Details >

MaxButtons <= 9.8.5 – Reflected Cross-Site Scripting via ‘view’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-13245
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

MaxButtons – Create buttons [maxbuttons]

Researcher

More Details >

Osiris Signature Banner <= 0.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting via ‘prepend_text’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8905
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Osiris Signature Banner [osiris-signature-banner]

Researcher

More Details >

Perfmatters <= 2.6.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-56047
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Perfmatters [perfmatters]

Researcher

More Details >

Quick Interest Slider <= 3.1.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-56039
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Quick Interest Slider [quick-interest-slider]

Researcher

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.3.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57314
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

More Details >

TablePress – Tables in WordPress made easy <= 3.3.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-56051
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

TablePress – Tables in WordPress made easy [tablepress]

Researcher

More Details >

weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce <= 2.1.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57322
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce [wemail]

Researcher

More Details >

Advanced Contact Form 7 <= 1.0.0 – Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via ‘form_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12094
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Advanced Contact Form 7 – Compact DB [advanced-contact-form-7-compact-db]

Researcher

More Details >

BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection <= 5.0.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56035
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection [bitfire]

Researcher

More Details >

Block for Mailchimp – Add Email Subscription Forms and Collect Leads <= 1.1.15 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56063
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Block for Mailchimp – Add Email Subscription Forms and Collect Leads [block-for-mailchimp]

Researcher

More Details >

Blocksy Companion Pro <= 2.1.46 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57630
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Blocksy Companion Pro [blocksy-companion-pro]

Researcher

More Details >

Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57660
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment [booking-and-rental-manager-for-woocommerce]

Researcher

More Details >

BookPro – Appointment Booking WordPress Plugin <= 1.1.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-66123
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

BookPro – Appointment Booking WordPress Plugin [ovabookpro]

Researcher

More Details >

Bopo – WooCommerce Product Bundle Builder <= 1.1.6 – Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57664
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Bopo – WooCommerce Product Bundle Builder [bopo-woo-product-bundle-builder]

Researcher

More Details >

CorvusPay WooCommerce Payment Gateway <= 2.7.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56029
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

CorvusPay WooCommerce Payment Gateway [corvuspay-woocommerce-integration]

Researcher

More Details >

Devs Accounting <= 1.2.0 – Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9172
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Devs Accounting – Simple Accounting and Invoicing Solution [devs-accounting]

Researcher

More Details >

Devs Accounting <= 1.2.0 – Missing Authorization to Unauthenticated Sensitive Information Exposure via ‘id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9175
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Devs Accounting – Simple Accounting and Invoicing Solution [devs-accounting]

Researcher

More Details >

Donation Thermometer <= 2.2.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-64636
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Donation Thermometer [donation-thermometer]

Researcher

More Details >

Frontend File Manager Plugin <= 23.6 – Missing Authorization to Unauthenticated File Download

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8379
Patch Status
Unpatched
Published
Jun 25, 2026

Affected Software

Frontend File Manager Plugin [nmedia-user-file-uploader]

Researcher

More Details >

GIFT4U – Gift Cards All in One for Woo <= 1.0.10 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57324
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]

Researcher

More Details >

GravityView <= 3.0.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57665
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

GravityView [gravityview]

Researcher

More Details >

HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.11.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57323
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

HTML5 Video Player – Embed and Play Videos in Custom Player [html5-video-player]

Researcher

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57652
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

More Details >

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.1.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27366
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child]

Researcher

More Details >

NEX-Forms <= 9.2.2 – Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12404
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56048
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Payment Gateway Based Fees and Discounts for WooCommerce [checkout-fees-for-woocommerce]

Researcher

More Details >

Pie Register – User Registration, Profiles & Content Restriction < 3.8.4.10 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-10530
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

Pie Register – User Registration, Profiles & Content Restriction [pie-register]

Researcher

More Details >

PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.18 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56050
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

PPOM – Product Addons & Custom Fields for WooCommerce [woocommerce-product-addon]

Researcher

More Details >

Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56060
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Print Invoice & Delivery Notes for WooCommerce [woocommerce-delivery-notes]

Researcher

More Details >

RegistrationMagic <= 6.0.8.6 – Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9242
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

More Details >

RentMy Real-Time Rental Management Plugin <= 4.0.4.1 – Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8690
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

RentMy Real-Time Rental Management Plugin [rentmy-online-rental-shop]

Researcher

More Details >

SearchPlus <= 1.7.1 – Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8617
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

SearchPlus [searchplus]

Researcher

More Details >

Secufor_OAuth <= 1.0.7 – Missing Authorization to Unauthenticated Account Logout via ‘secuforoauth_unregister_action’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-7617
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Secufor_OAuth [wpoauth]

Researcher

More Details >

ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.4 – Unauthenticated Arbitrary File Deletion

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56066
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization [shortpixel-adaptive-images]

Researcher

More Details >

SiteGround Email Marketing <= 1.7.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-24547
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

SiteGround Email Marketing [siteground-email-marketing]

Researcher

More Details >

Stripe Payment Forms by WP Full Pay <= 8.4.3 – Missing Authorization to Unauthenticated Payment Record Manipulation via ‘paymentIntentId’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12432
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions [wp-full-stripe-free]

Researcher

More Details >

Subscriptions for WooCommerce <= 1.9.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56061
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

More Details >

Toolset Forms <= 2.6.24 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56069
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Toolset Forms [cred-frontend-editor]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52701
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WCBoost – Products Compare <= 1.1.0 – Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57633
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WCBoost – Products Compare [wcboost-products-compare]

Researcher

More Details >

WhatsOrder <= 1.0.1 – Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9612
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WhatsOrder – Instant Checkout for WooCommerce [whatsorder-instant-checkout-for-woocommerce]

Researcher

More Details >

FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.5 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-56052
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

FunnelKit – Funnel Builder for WooCommerce Checkout [funnel-builder]

Researcher

More Details >

Infility Global < 2.15.20 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-7842
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Infility Global [infility-global]

Researcher

More Details >

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.0.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-57631
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups [ays-popup-box]

Researcher

More Details >

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-57628
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import]

Researcher

More Details >

Gutenverse <= 3.8.0 – Authenticated (Editor+) Stored Cross-Site Scripting via ‘fonts[].font.font.value’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12399
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse]

Researchers

More Details >

Ivory Search <= 5.5.15 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘menu_title’ and ‘menu_magnifier_color’ Settings

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-11356
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Ivory Search – WordPress Search Plugin [add-search-to-menu]

Researcher

More Details >

24liveblog <= 2.2 – Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9183
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

24liveblog – live blog tool [24liveblog]

Researcher

More Details >

24liveblog <= 2.2 – Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9184
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

24liveblog – live blog tool [24liveblog]

Researcher

More Details >

Abandoned Cart Lite for WooCommerce <= 6.8.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57637
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Abandoned Cart Lite for WooCommerce [woocommerce-abandoned-cart]

Researcher

More Details >

Advance Nav Menu Manager <= 1.3 – Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8688
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Advance Nav Menu Manager [advance-nav-menu-manager]

Researcher

More Details >

Affiliates Manager <= 2.9.49 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57654
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Affiliates Manager [affiliates-manager]

Researcher

More Details >

Assistio <= 1.1.2 – Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8614
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Assistio [assistio]

Researcher

More Details >

Blue Captcha <= 2.0.1 – Cross-Site Request Forgery via ‘blcap_action’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10552
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Blue Captcha [blue-captcha]

Researcher

More Details >

Book a Room Event Calendar <= 1.9 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9721
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Book a Room Event Calendar [book-a-room-event-calendar]

Researcher

More Details >

Bulk SEO Image <= 1.1 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11997
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Bulk SEO Image [bulk-seo-image]

Researcher

More Details >

Child Theme Wizard <= 1.4 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57655
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Child Theme Wizard [child-theme-wizard]

Researcher

More Details >

Cornerstone < 7.8.8 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9710
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Cornerstone [cornerstone]

Researcher

More Details >

Cornerstone < 7.8.9 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9709
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Cornerstone [cornerstone]

Researcher

More Details >

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 – Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via ‘id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11987
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

Eagle Booking <= 1.3.4.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-68052
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Eagle Booking [eagle-booking]

Researcher

More Details >

Elementor Website Builder – more than just a page builder <= 4.1.3 – Authenticated (Contributor+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57619
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Elementor Website Builder – more than just a page builder [elementor]

Researcher

More Details >

Email Marketing for WooCommerce by Omnisend <= 1.19.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57632
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Email Marketing for WooCommerce by Omnisend [omnisend-connect]

Researcher(s): Unknown

More Details >

Forget About Shortcode Buttons <= 2.1.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-63041
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Forget About Shortcode Buttons [forget-about-shortcode-buttons]

Researcher

More Details >

FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57635
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

FunnelKit Payment Gateway for Stripe WooCommerce [funnelkit-stripe-woo-payment-gateway]

Researcher

More Details >

Generate Security.txt <= 1.0.12 – Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9616
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Generate Security.txt [generate-security-txt]

Researcher

More Details >

GetGenie – AI Content Writer with Keyword Research & SEO Tracking <= 4.4.2 – Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57316
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

GetGenie – AI Content Writer with Keyword Research & SEO Tracking [getgenie]

Researcher

More Details >

Gmail SMTP <= 1.2.3.19 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57657
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Gmail SMTP [gmail-smtp]

Researcher

More Details >

HD Quiz 2.2.0 – 2.2.1 – Cross-Site Request Forgery via Multiple AJAX Handlers

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-13422
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

HD Quiz [hd-quiz]

Researcher

More Details >

Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator <= 1.5.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-63079
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste]

Researcher

More Details >

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.1.7 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57646
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]

Researcher

More Details >

Masteriyo LMS <= 2.2.1 – Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11773
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57640
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

MotorDesk <= 1.1.2 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9724
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

MotorDesk [motordesk]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin < 1.4.110 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7859
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

MP Customize Login Page <= 1.0 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-6292
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

MP Customize Login Page [mp-customize-login-page]

Researcher

More Details >

Nelio Content – Editorial Calendar & Social Media Auto-Posting <= 4.3.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57648
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Nelio Content – Editorial Calendar & Social Media Auto-Posting [nelio-content]

Researcher

More Details >

Newsletters <= 4.13 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57645
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

Paid Memberships Pro – Add Member From Admin <= 0.7.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57659
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Paid Memberships Pro – Add Member From Admin [pmpro-add-member-admin]

Researcher

More Details >

PPWP – Password Protect Pages <= 1.9.19 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57634
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

PPWP – Password Protect Pages [password-protect-page]

Researcher

More Details >

Product Specifications for Woocommerce <= 0.8.9 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via ‘dwps_modify_groups’ and ‘dwps_modify_attributes’ AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11364
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Product Specifications for Woocommerce [product-specifications]

Researcher

More Details >

Quiz and Survey Master (QSM) <= 11.1.4 – Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9233
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker [quiz-master-next]

Researcher

More Details >

Real Estate 7 WordPress <= 3.5.9 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57641
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Real Estate 7 WordPress [realestate-7]

Researcher

More Details >

Restaurant Menu and Food Ordering <= 2.4.11 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-63078
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Restaurant Menu and Food Ordering [mp-restaurant-menu]

Researcher

More Details >

Reviews and Rating <= 1.1.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9619
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Reviews and Rating – Docplanner [reviews-and-rating-docplanner]

Researcher

More Details >

SEOPress PRO <= 9.1.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57430
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

SEOPress PRO [wp-seopress-pro]

Researcher

More Details >

Shoppable Images (Lookbook) for WooCommerce <= 1.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57649
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Shoppable Images (Lookbook) for WooCommerce [mabel-shoppable-images-lite]

Researcher

More Details >

Site Reviews <= 8.0.11 – Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57318
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Site Reviews [site-reviews]

Researcher

More Details >

Slim SEO – A Fast & Automated SEO Plugin For WordPress <= 4.6.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57429
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Slim SEO – A Fast & Automated SEO Plugin For WordPress [slim-seo]

Researcher

More Details >

Spexo <= 2.0.11 – Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12471
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Spexo [spexo]

Researcher

More Details >

Travel Booking <= 2.2.5 – Authenticated (Subscriber+) Arbitrary File Upload

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-56059
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Travel Booking [travel-booking]

Researcher

More Details >

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.14 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57622
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

b1c4c306fad16439d9178a0d349f0c40L4m

More Details >

WPComplete <= 2.9.5.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57661
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WPComplete [wpcomplete]

Researcher

More Details >

Site Kit by Google – Analytics, Search Console, AdSense, Speed < 1.176.0 – Missing Authorization to Authenticated (Editor+) Settings Update

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-10753
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Site Kit by Google – Analytics, Search Console, AdSense, Speed [google-site-kit]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 22, 2026 to June 28, 2026) appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (June 15, 2026 to June 21, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-15-2026-to-june-21-2026/ Thu, 25 Jun 2026 19:39:41 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-15-2026-to-june-21-2026/ Last week, there were 146 vulnerabilities disclosed in 127 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 85 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 139
Unpatched 7

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 90
High Severity 48
Critical Severity 7

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Missing Authorization 36
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 31
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 26
Exposure of Sensitive Information to an Unauthorized Actor 10
Authorization Bypass Through User-Controlled Key 7
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 7
Incorrect Privilege Assignment 5
Cross-Site Request Forgery (CSRF) 3
Deserialization of Untrusted Data 3
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
Improper Control of Generation of Code (‘Code Injection’) 3
Server-Side Request Forgery (SSRF) 3
Unrestricted Upload of File with Dangerous Type 3
Improper Privilege Management 2
Embedded Malicious Code 1
External Control of File Name or Path 1
Incorrect Authorization 1
Weak Password Recovery Mechanism for Forgotten Password 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

14

8

7

7

6

4

4

4

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
5b840087cae0a13b411eb404ad102a47
Yat

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
2Download Connector for 2DL Hosted Checkout 2download-connector
Abandoned Cart Pro for WooCommerce woocommerce-abandon-cart-pro
Abandoned Contact Form 7 abandoned-contact-form-7
Advanced Ads – Ad Manager & AdSense advanced-ads
Advanced Import advanced-import
Advanced Order Export For WooCommerce woo-order-export-lite
Appointment Booking Calendar appointment-booking-calendar
Attendance Manager attendance-manager
Avada (Fusion) Builder fusion-builder
BetterDocs Pro betterdocs-pro
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot betterdocs
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation bit-integrations
Blocksy Companion blocksy-companion
Bogo bogo
Branda – White Label & Branding, Free Login Page Customizer branda-white-labeling
Bricksable for Bricks Builder bricksable
Cargo Shipping Location for WooCommerce cargo-shipping-location-for-woocommerce
CF7 to Webhook cf7-to-zapier
CheckView – Form & Checkout Testing checkview
Classified Listing – AI-Powered Classified ads & Business Directory classified-listing
Clean Login clean-login
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery
Cornerstone cornerstone
Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress counter-box
Creavi Appointment Booking Calendar creavi-booking-service
Database for Contact Form 7, WPforms, Elementor forms contact-form-entries
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy dokan-lite
E2Pdf – Export Pdf Tool for WordPress e2pdf
Enable CORS enable-cors
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More envira-gallery-lite
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance accessibility-checker
Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets eventkoi-lite
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) wp-event-solution
Falang multilanguage for WordPress falang
Fancy Testimonials fancy-testimonials
FireBox Popups – Increase Sales and Grow Your Email List firebox
Five Star Restaurant Menu and Food Ordering food-and-drink-menu
Five Star Restaurant Reservations – WordPress Booking Plugin restaurant-reservations
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker
GEO my WP geo-my-wp
GEO Plugin by Squirrly SEO squirrly-seo
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
GetGenie – AI Content Writer with Keyword Research & SEO Tracking getgenie
GIFT4U – Gift Cards All in One for Woo gift4u-gift-cards-all-in-one-for-woo
Gutenverse Companion gutenverse-companion
Interactive Content – H5P h5p
Intranet & Private Site – All-In-One Intranet all-in-one-intranet
JetBooking jet-booking
JetEngine jet-engine
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
JobSearch WP Job Board wp-jobsearch
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor kadence-blocks
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder king-addons
LatePoint – Calendar Booking Plugin for Appointments and Events latepoint
License Manager for WooCommerce license-manager-for-woocommerce
Listdom: AI-powered Business Directory with Classifieds Ads Listings listdom
MapPress Maps for WordPress mappress-google-maps-for-wordpress
Master Slider – Responsive Touch Slider master-slider
MDTF – Meta Data and Taxonomies Filter wp-meta-data-filter-and-taxonomy-filter
Media Library Assistant media-library-assistant
Melhor Envio melhor-envio-cotacao
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
MStore API – Create Native Android & iOS Apps On The Cloud mstore-api
Newsletters newsletters-lite
Nexi XPay cartasi-x-pay
Object Cache 4 everyone object-cache-4-everyone
Ocean Product Sharing ocean-product-sharing
Offload, AI & Optimize with Cloudflare Images cf-images
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More themeisle-companion
Paymob for WooCommerce paymob-for-woocommerce
PDF Builder for WooCommerce. Create invoices,packing slips and more woo-pdf-invoice-builder
Permalink Manager Lite permalink-manager
Pods – Custom Content Types and Fields pods
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred mycred
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups ays-popup-box
PowerPress Podcasting plugin by Blubrry powerpress
Premmerce Dev Tools premmerce-dev-tools
Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist
PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin pressprimer-quiz
Quads Ads Manager for Google AdSense quick-adsense-reloaded
Registration Form for WooCommerce registration-form-for-woocommerce
Royal Addons for Elementor – Addons and Templates Kit for Elementor royal-elementor-addons
Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini royal-mcp
RTMKit rometheme-for-elementor
SALESmanago & Leadoo salesmanago
Secure Client Portal and Private File Sharing Plugin – User Private Files user-private-files
Services Section Block – Showcase Service Details in Grid or Columns services-section
Sigma Forms Pro sigmaforms-pro
Simple File List simple-file-list
Simple Membership simple-membership
Slideshow Gallery LITE slideshow-gallery
SlimStat Analytics wp-slimstat
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery sms-alert
Static Block static-block
STRABL – A checkout solution strabl-a-checkout-solution
Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator stylish-cost-calculator
SupportCandy – Helpdesk & Customer Support Ticket System supportcandy
SureDash – Community, Courses & Member Dashboard suredash
Syncee Premium Dropshipping & Wholesale syncee-global-dropshipping
SysBasics Customize My Account for WooCommerce – Live My Account Customizer customize-my-account-for-woocommerce
Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups trinity-backup
Tutor LMS – eLearning and online course solution tutor
UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce
User Admin Simplifier user-admin-simplifier
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP userswp
Video Conferencing with Zoom video-conferencing-with-zoom-api
Visual Link Preview visual-link-preview
Vitepos – Point of Sale (POS) for WooCommerce vitepos-lite
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce woosquare
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors wc-vendors
WCPOS – Point of Sale (POS) plugin for WooCommerce woocommerce-pos
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets widget-options
WooCommerce Stripe Payment Gateway woocommerce-gateway-stripe
Woosa – Marktplaats for WooCommerce integration-marktplaats-for-woocommerce
Workscout Core workscout-core
WP Activity Log wp-security-audit-log
WP DSGVO Tools (GDPR) shapepress-dsgvo
WP Easy Pay – Payment and Donation form Builder for Square wp-easy-pay
Wp EMember wp-eMember
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map wp-google-maps
WP Hotel Booking wp-hotel-booking
WP Photo Album Plus wp-photo-album-plus
WP Review Slider Pro wp-review-slider-pro
WP Travel Gutenberg Blocks wp-travel-blocks
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables
YMC Filter ymc-smart-filter

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Real Estate 7 WordPress realestate-7

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

BetterDocs Pro <= 3.8.0 – Unauthenticated Local File Inclusion via doc_style

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-7515
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

BetterDocs Pro [betterdocs-pro]

Researcher

More Details >

Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-11551
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Branda – White Label & Branding, Free Login Page Customizer [branda-white-labeling]

Researchers

More Details >

Enable CORS <= 2.0.3 – Backdoor

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-54833
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Enable CORS [enable-cors]

Researcher

More Details >

Registration Form for WooCommerce <= 1.0.9 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-54807
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Registration Form for WooCommerce [registration-form-for-woocommerce]

Researcher

More Details >

Sigma Forms Pro <= 1.4.5 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-52705
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Sigma Forms Pro [sigmaforms-pro]

Researcher

More Details >

Avada (Fusion) Builder <= 3.15.3 – Unauthenticated Arbitrary File Deletion via Form Entry Value

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-8713
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

Workscout Core <= 1.7.11 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-52716
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Workscout Core [workscout-core]

Researcher

More Details >

Abandoned Cart Pro for WooCommerce <= 10.4.0 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56010
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]

Researcher

More Details >

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56008
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

Contest Gallery <= 30.0.2 – Authenticated (Author+) Privilege Escalation via ‘RegistryUserRole’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12165
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researchers

More Details >

E2Pdf <= 1.32.26 – Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via ‘screen_action’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12407
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

E2Pdf – Export Pdf Tool for WordPress [e2pdf]

Researcher

More Details >

Falang multilanguage for WordPress <= 1.4.2 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-54805
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Falang multilanguage for WordPress [falang]

Researcher

More Details >

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.1 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-54196
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Offload, AI & Optimize with Cloudflare Images <= 1.10.2 – Authenticated (Author+) Remote Code Execution via ‘api-key’ / ‘account-id’ Parameters in cf_images_do_setup AJAX Action

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-9860
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Offload, AI & Optimize with Cloudflare Images [cf-images]

Researcher

5b840087cae0a13b411eb404ad102a47Yat

More Details >

PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 – Authenticated (Subscriber+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-52704
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]

Researcher

More Details >

Premmerce Dev Tools <= 2.0 – Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-6933
Patch Status
Unpatched
Published
Jun 15, 2026

Affected Software

Premmerce Dev Tools [premmerce-dev-tools]

Researcher

More Details >

Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.3 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-54823
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets [widget-options]

Researcher

More Details >

WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) SQL Injection via ‘curselrevs’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-8444
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) SQL Injection via ‘stypes’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-8443
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

Advanced Ads – Ad Manager & AdSense <= 2.0.21 – Authenticated (Contributor+) Remote Code Execution

8.3

CVSS Rating
8.3 (High)
CVE-ID

CVE-2026-54816
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Advanced Ads – Ad Manager & AdSense [advanced-ads]

Researcher

More Details >

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-54193
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 – Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-9843
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Database for Contact Form 7, WPforms, Elementor forms [contact-form-entries]

Researcher

More Details >

MDTF – Meta Data and Taxonomies Filter <= 1.3.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-54845
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]

Researcher

More Details >

WP Activity Log <= 5.6.3.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-54806
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

WP Activity Log [wp-security-audit-log]

Researcher

More Details >

WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) Arbitrary File Deletion via ‘myaction’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-8442
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54194
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

Cargo Shipping Location for WooCommerce <= 5.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54815
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Cargo Shipping Location for WooCommerce [cargo-shipping-location-for-woocommerce]

Researcher

More Details >

GEO my WP <= 4.5.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-52715
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

GEO my WP [geo-my-wp]

Researcher

More Details >

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54831
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

More Details >

GIFT4U – Gift Cards All in One for Woo <= 1.0.10 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54809
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]

Researcher

More Details >

JetBooking <= 4.0.4.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54820
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

JetBooking [jet-booking]

Researcher

More Details >

JetEngine <= 3.8.10.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54187
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetEngine <= 3.8.10.1 – Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12360
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JobSearch WP Job Board <= 3.2.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54186
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JobSearch WP Job Board [wp-jobsearch]

Researcher

More Details >

LatePoint <= 5.5.1 – Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-8176
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

LatePoint – Calendar Booking Plugin for Appointments and Events [latepoint]

Researcher

More Details >

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.4.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54819
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom]

Researcher

More Details >

MDTF – Meta Data and Taxonomies Filter <= 1.3.7 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54843
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Authenticated (Subscriber+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54814
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54812
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Premmerce Wishlist for WooCommerce <= 1.1.11 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54849
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Premmerce Wishlist for WooCommerce [premmerce-woocommerce-wishlist]

Researcher

More Details >

Real Estate 7 WordPress <= 3.5.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54827
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Real Estate 7 WordPress [realestate-7]

Researcher

More Details >

Simple File List <= 6.3.7 – Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-11912
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Simple File List [simple-file-list]

Researchers

More Details >

Simple File List <= 6.3.7 – Unauthenticated Arbitrary File Deletion via Path Traversal in ‘eeSubFolder’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-11911
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Simple File List [simple-file-list]

Researchers

More Details >

Wp EMember < v10.9.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54811
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Wp EMember [wp-eMember]

Researcher

More Details >

WP Photo Album Plus <= 9.1.13.005 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54829
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WP Travel Gutenberg Blocks <= 3.9.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54808
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

WP Travel Gutenberg Blocks [wp-travel-blocks]

Researcher

More Details >

wpDataTables (Premium) <= 7.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54825
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables]

Researcher

More Details >

YMC Filter <= 3.11.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54836
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

YMC Filter [ymc-smart-filter]

Researcher

More Details >

CF7 to Webhook <= 5.0.0 – Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-11395
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

CF7 to Webhook [cf7-to-zapier]

Researcher

More Details >

JetEngine <= 3.8.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-54189
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetEngine <= 3.8.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-54188
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.0.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-54195
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

MapPress Maps for WordPress <= 2.97.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56011
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

MapPress Maps for WordPress [mappress-google-maps-for-wordpress]

Researcher

More Details >

Master Slider – Responsive Touch Slider <= 3.11.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56014
Patch Status
Unpatched
Published
Jun 19, 2026

Affected Software

Master Slider – Responsive Touch Slider [master-slider]

Researcher

More Details >

Pods – Custom Content Types and Fields <= 3.3.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-54191
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Pods – Custom Content Types and Fields [pods]

Researcher

More Details >

Counter Box <= 2.0.13 – Authenticated (Administrator+) PHP Object Injection via Import

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-12115
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress [counter-box]

Researcher

More Details >

Attendance Manager <= 0.6.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-52712
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Attendance Manager [attendance-manager]

Researcher

More Details >

Bit integrations <= 2.8.7 – Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-11989
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation [bit-integrations]

Researcher

More Details >

Cornerstone < 7.8.8 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54185
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Cornerstone [cornerstone]

Researcher

More Details >

Media Library Assistant <= 3.35 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-56012
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 – 1.7.1059 – Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-8118
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

More Details >

RTMKit <= 2.0.7 – Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via ‘entries_id’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-5149
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

RTMKit [rometheme-for-elementor]

Researcher

More Details >

SALESmanago & Leadoo <= 3.11.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54822
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SALESmanago & Leadoo [salesmanago]

Researcher

More Details >

Simple File List <= 6.3.7 – Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via ‘frontmanage’ Shortcode Attribute

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12119
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Simple File List [simple-file-list]

Researchers

More Details >

SlimStat Analytics <= 5.4.11 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54818
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SlimStat Analytics [wp-slimstat]

Researcher

More Details >

SureDash – Community, Courses & Member Dashboard <= 1.8.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54813
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

More Details >

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.8 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54838
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors [wc-vendors]

Researcher

More Details >

WooCommerce Stripe Payment Gateway <= 10.7.0 – Missing Authorization to Unauthenticated Order Status Manipulation via ‘order’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-2381
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WooCommerce Stripe Payment Gateway [woocommerce-gateway-stripe]

Researcher

More Details >

Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 – Authenticated (Author+) Server-Side Request Forgery via ‘demo_file’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4328
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Advanced Import [advanced-import]

Researcher

More Details >

Appointment Booking Calendar <= 1.4.4 – Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-1856
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Creavi Appointment Booking Calendar [creavi-booking-service]

Researchers

More Details >

BetterDocs <= 4.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘blockId’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12157
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot [betterdocs]

Researcher

More Details >

Bricksable for Bricks Builder <= 1.6.83 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56009
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Bricksable for Bricks Builder [bricksable]

Researcher

More Details >

Fancy Testimonials <= 1.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8039
Patch Status
Unpatched
Published
Jun 17, 2026

Affected Software

Fancy Testimonials [fancy-testimonials]

Researcher

More Details >

File Sharing & Download Manager <= 2.1.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘fldr_ttl’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10093
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Secure Client Portal and Private File Sharing Plugin – User Private Files [user-private-files]

Researcher

More Details >

King Addons for Elementor <= 51.1.62 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘form_page_id’ Parameter

6.4

CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘wrap’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8607
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]

Researcher

More Details >

Permalink Manager Lite <= 2.5.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8494
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Permalink Manager Lite [permalink-manager]

Researcher

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.16.8 – Authenticated (Author+) Stored Cross-Site Scripting via ’embed’ Episode Meta Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12098
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

More Details >

Services Section Block <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘link’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11402
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Services Section Block – Showcase Service Details in Grid or Columns [services-section]

Researcher

More Details >

Slideshow Gallery LITE <= 1.8.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘alwaysauto’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2021
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Slideshow Gallery LITE [slideshow-gallery]

Researcher

More Details >

SysBasics Customize My Account for WooCommerce <= 4.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12136
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SysBasics Customize My Account for WooCommerce – Live My Account Customizer [customize-my-account-for-woocommerce]

Researchers

More Details >

WP Activity Log <= 5.6.3.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56005
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

WP Activity Log [wp-security-audit-log]

Researcher

More Details >

Interactive Content – H5P <= 1.17.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-56006
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Interactive Content – H5P [h5p]

Researcher

More Details >

Media Library Assistant <= 3.35 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-54198
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.2.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-54192
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups [ays-popup-box]

Researcher

More Details >

SysBasics Customize My Account for WooCommerce <= 4.3.6 – Reflected Cross-Site Scripting via ‘tab’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-12137
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SysBasics Customize My Account for WooCommerce – Live My Account Customizer [customize-my-account-for-woocommerce]

Researchers

More Details >

2Download Connector for 2DL Hosted Checkout <= 0.1.5 – Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via ‘ToDownload_email’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6798
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

2Download Connector for 2DL Hosted Checkout [2download-connector]

Researcher

More Details >

Abandoned Contact Form 7 <= 2.2 – Missing Authorization to Unauthenticated Arbitrary Post Deletion via ‘recover_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9187
Patch Status
Unpatched
Published
Jun 15, 2026

Affected Software

Abandoned Contact Form 7 [abandoned-contact-form-7]

Researcher

More Details >

CheckView – Form & Checkout Testing <= 2.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54844
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

CheckView – Form & Checkout Testing [checkview]

Researcher

More Details >

Clean Login <= 1.15 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54184
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Clean Login [clean-login]

Researcher

More Details >

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.12.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54190
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Event Koi Lite <= 1.3.13.1 – Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-10029
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets [eventkoi-lite]

Researcher

More Details >

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-68045
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution]

Researcher

More Details >

FireBox Popups <= 3.1.7 – Unauthenticated Sensitive Information Exposure in ‘form_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12120
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

FireBox Popups – Increase Sales and Grow Your Email List [firebox]

Researcher

More Details >

Five Star Restaurant Menu and Food Ordering <= 2.5.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54835
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Five Star Restaurant Menu and Food Ordering [food-and-drink-menu]

Researcher

More Details >

Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.19 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54830
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Five Star Restaurant Reservations – WordPress Booking Plugin [restaurant-reservations]

Researcher

More Details >

GEO Plugin by Squirrly SEO <= 12.4.16 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52714
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

GEO Plugin by Squirrly SEO [squirrly-seo]

Researcher

More Details >

GetGenie – AI Content Writer with Keyword Research & SEO Tracking <= 4.4.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54197
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

GetGenie – AI Content Writer with Keyword Research & SEO Tracking [getgenie]

Researcher

More Details >

Gutenverse Companion <= 2.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54832
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Gutenverse Companion [gutenverse-companion]

Researcher

More Details >

Intranet & Private Site – All-In-One Intranet <= 1.8.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54837
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Intranet & Private Site – All-In-One Intranet [all-in-one-intranet]

Researcher

More Details >

License Manager for WooCommerce <= 3.0.15 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56013
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

License Manager for WooCommerce [license-manager-for-woocommerce]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54828
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54817
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

MStore API – Create Native Android & iOS Apps On The Cloud [mstore-api]

Researcher

More Details >

Newsletters <= 4.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54840
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

Nexi XPay <= 8.3.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54810
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Nexi XPay [cartasi-x-pay]

Researcher

More Details >

Object Cache 4 everyone <= 2.3.2 – Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54834
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Object Cache 4 everyone [object-cache-4-everyone]

Researcher

More Details >

Paymob for WooCommerce <= 4.1.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56025
Patch Status
Unpatched
Published
Jun 19, 2026

Affected Software

Paymob for WooCommerce [paymob-for-woocommerce]

Researcher

More Details >

Quads Ads Manager for Google AdSense <= 3.0.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54824
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Quads Ads Manager for Google AdSense [quick-adsense-reloaded]

Researcher

More Details >

Simple Membership <= 4.7.5 – Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe ‘charge.refunded’ Webhook

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12093
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

More Details >

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54802
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

More Details >

STRABL <= 4.5 – Unauthenticated Arbitrary Webhook Creation via REST API Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-3640
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

STRABL – A checkout solution [strabl-a-checkout-solution]

Researcher

More Details >

Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator <= 8.3.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54847
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator [stylish-cost-calculator]

Researcher

More Details >

Syncee Premium Dropshipping & Wholesale <= 1.0.27 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54846
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Syncee Premium Dropshipping & Wholesale [syncee-global-dropshipping]

Researcher

More Details >

Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54839
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups [trinity-backup]

Researcher

More Details >

Video Conferencing with Zoom <= 4.6.7 – Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via ‘get_auth’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6964
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Video Conferencing with Zoom [video-conferencing-with-zoom-api]

Researcher

More Details >

Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54841
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]

Researcher

More Details >

WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54848
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce [woosquare]

Researcher

More Details >

WCPOS – Point of Sale (POS) plugin for WooCommerce <= 1.8.14 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52711
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WCPOS – Point of Sale (POS) plugin for WooCommerce [woocommerce-pos]

Researcher

More Details >

WP DSGVO Tools (GDPR) <= 3.1.39 – Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-10034
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

WP DSGVO Tools (GDPR) [shapepress-dsgvo]

Researcher

More Details >

WP Go Maps <= 10.1.01 – Unauthenticated Arbitrary Record Creation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12238
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]

Researcher

More Details >

Advanced Order Export For WooCommerce <= 4.0.10 – Authenticated (Shop Manager+) SQL Injection via ‘sort_direction’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-11360
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Advanced Order Export For WooCommerce [woo-order-export-lite]

Researcher

More Details >

Form Maker by 10Web <= 1.15.43 – Authenticated (Administrator+) SQL Injection via ‘name’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-11777
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

More Details >

Form Maker by 10Web <= 1.15.43 – Authenticated (Adminsitrator+) SQL Injection via ‘groupids’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-11776
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

More Details >

Tutor LMS <= 3.9.11 – Authenticated (Administrator+) SQL Injection via ‘data’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-10736
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Woosa <= 2.0.5 – Authenticated (Administrator+) Arbitrary File Read via ‘log_file’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-7547
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Woosa – Marktplaats for WooCommerce [integration-marktplaats-for-woocommerce]

Researcher

More Details >

Blocksy Companion <= 2.1.45 – Authenticated (Editor+) Stored Cross-Site Scripting via ‘product_description’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12430
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Blocksy Companion [blocksy-companion]

Researcher

More Details >

Ocean Product Sharing <= 2.2.2 – Authenticated (Shop manager+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-56007
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Ocean Product Sharing [ocean-product-sharing]

Researcher

More Details >

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘menu-item-icon’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-11358
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion]

Researcher

More Details >

Appointment Booking Calendar <= 1.4.01 – Authenticated (Contributor+) Sensitive Information Exposure via ‘id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12111
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Appointment Booking Calendar [appointment-booking-calendar]

Researchers

More Details >

Bogo <= 3.9.1 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9013
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Bogo [bogo]

Researcher

More Details >

Classified Listing <= 5.4.2 – Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers (‘listingId’/’id’ Parameters)

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10779
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]

Researcher

More Details >

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 – Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10023
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

Equalize Digital Accessibility Checker <= 1.42.1 – Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via ‘largeBatch’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9199
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance [accessibility-checker]

Researcher

More Details >

Kadence Blocks <= 3.7.5 – Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11357
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

More Details >

Melhor Envio <= 2.16.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-54804
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Melhor Envio [melhor-envio-cotacao]

Researcher

More Details >

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 – Cross-Site Request Forgery via ‘optml_replace_file’ AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11784
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

More Details >

PressPrimer Quiz <= 2.3.0 – Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via ‘quiz_id’, ‘item_id’, and ‘rule_id’ Parameters

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10623
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin [pressprimer-quiz]

Researcher

More Details >

Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini <= 1.4.25 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-54842
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini [royal-mcp]

Researcher

More Details >

Static Block <= 2.2 – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode ‘id’ Attribute

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10780
Patch Status
Unpatched
Published
Jun 15, 2026

Affected Software

Static Block [static-block]

Researcher

More Details >

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.6 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-54826
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SupportCandy – Helpdesk & Customer Support Ticket System [supportcandy]

Researcher

More Details >

UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-56023
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

UPI QR Code Payment Gateway for WooCommerce [upi-qr-code-payment-for-woocommerce]

Researcher

More Details >

User Admin Simplifier <= 3.0.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11775
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

User Admin Simplifier [user-admin-simplifier]

Researcher

More Details >

Visual Link Preview <= 2.3.1 – Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-54821
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Visual Link Preview [visual-link-preview]

Researcher

More Details >

WP Easy Pay – Payment and Donation form Builder for Square <= 4.5.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-56024
Patch Status
Unpatched
Published
Jun 18, 2026

Affected Software

WP Easy Pay – Payment and Donation form Builder for Square [wp-easy-pay]

Researcher

More Details >

WP Hotel Booking < 2.3.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9822
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

More Details >

UsersWP <= 1.2.63 – Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via ‘user_id’ Parameter

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-12102
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 15, 2026 to June 21, 2026) appeared first on Wordfence.

]]> Critical Unauthenticated Arbitrary File Deletion Vulnerability Patched in Avada Builder WordPress Plugin https://swiftupdates.ca/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/ Thu, 18 Jun 2026 18:38:41 +0000 https://swiftupdates.ca/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/ On May 13th, 2026, we received a submission for a critical Unauthenticated Arbitrary File Deletion vulnerability in Avada Builder, a premium WordPress plugin with an estimated 1,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file, such as wp-config.php, is deleted. Exploitation requires a published Avada form configured to save entries to the database.

Props to daroo who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $3,600.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.

All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites running the free version of Wordfence, are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in path traversal protection.

We provided full disclosure details to the Avada team through our Wordfence Vulnerability Management Portal on May 15, 2026. The developer acknowledged the report and submitted a patch on May 19, 2026. We would like to commend the Avada team for their prompt response and timely patch.

We urge users to update their sites to the latest patched version of Avada Builder as soon as possible.

Vulnerability Summary from Wordfence Intelligence

Avada (Fusion) Builder <= 3.15.3 – Unauthenticated Arbitrary File Deletion via Form Entry Value

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-8713
Affected Version(s)
<= 3.15.3
Patched Version
3.15.4
Bounty
$3,600.00

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate ‘delete’ cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.

More Details >

Technical Analysis

Avada Builder is a premium drag-and-drop page builder plugin for WordPress, bundled with the popular Avada theme. It includes a form builder feature that allows site administrators to create custom forms, embed them on pages via a shortcode, and optionally save submitted entries to the database. The form builder also supports a privacy cleanup feature that can automatically delete or anonymize stored submissions after a configurable expiration period.

When the cleanup routine runs, or when the administrator manually deletes the form entry, the plugin invokes the maybe_delete_files() function from the Fusion_Form_DB_Entries class for the stored entry, which is where the actual file deletion takes place:

public function maybe_delete_files( $id, $id_column = 'id' ) {
	$args                           = [];
	$args[ esc_attr( $id_column ) ] = $id;
	$entries                        = $this->get( [ 'where' => $args ] );

	if ( is_array( $entries ) && ! empty( $entries ) ) {
		$upload         = wp_upload_dir();
		$upload['path'] = $upload['basedir'] . '/fusion-forms';
		$upload['url']  = $upload['baseurl'] . '/fusion-forms';

		foreach ( $entries as $entry ) {

			// Check if it holds a file URL.
			if ( $entry && isset( $entry->value ) && false !== strpos( $entry->value, $upload['url'] ) ) {
				$values = explode( ' | ', $entry->value );

				foreach ( $values as $value ) {
					$file_path = str_replace( $upload['url'], $upload['path'], $value );

					// File exists, delete it.
					if ( file_exists( $file_path ) ) {
						wp_delete_file( $file_path );
					}
				}
			}
		}
	}
}

The function searches each stored entry value for the Avada Forms upload URL. If found, it builds a filesystem path by string-replacing the URL prefix with the local upload directory path and deletes the resulting target with the wp_delete_file() function. Unfortunately, the function does not perform any realpath resolution or upload-directory containment check, meaning that path traversal sequences are preserved in the final file path.

By submitting a form with a text field value such as http://victim.com/wp-content/uploads/fusion-forms/․․/․․/․․/wp-config.php, an unauthenticated attacker can plant an entry that causes wp-config.php to be deleted when the entry is removed.

Once wp-config.php is deleted, the WordPress installation enters its initial setup state, which can be leveraged for site takeover by pointing the installation at an attacker-controlled database. From there, the attacker can install plugins or themes containing malicious PHP code, ultimately achieving remote code execution.

As with all arbitrary file deletion vulnerabilities, this can lead to complete site compromise.

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

fusion builder file delete howto wordfence firewall

The Wordfence firewall rule detects the path traversal sequence in the submitted form data and blocks the request.

Disclosure Timeline

May 13, 2026 – We received the submission for the Unauthenticated Arbitrary File Deletion vulnerability in Avada Builder via the Wordfence Bug Bounty Program.
May 15, 2026 – We validated the report and confirmed the proof-of-concept exploit. Full disclosure details were sent instantly to the vendor through our Wordfence Vulnerability Management Portal.
May 19, 2026 – The vendor acknowledged the report and submitted a patch.
June 2, 2026 – The fully patched version of the plugin, 3.15.4, was released.

Conclusion

In this blog post, we detailed a critical Unauthenticated Arbitrary File Deletion vulnerability within the Avada Builder plugin affecting all versions up to, and including, 3.15.3. This vulnerability allows unauthenticated threat actors to delete arbitrary files on the server by abusing the form builder’s privacy cleanup feature, leading to complete site compromise when critical files such as wp-config.php are deleted. The vulnerability has been fully addressed in version 3.15.4 of the plugin.

We encourage WordPress users to verify that their sites are updated to the latest patched version of Avada Builder as soon as possible considering the critical nature of this vulnerability.

All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites running the free version of Wordfence, are fully protected against this vulnerability by the Wordfence firewall’s built-in path traversal protection.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.

The post Critical Unauthenticated Arbitrary File Deletion Vulnerability Patched in Avada Builder WordPress Plugin appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (June 8, 2026 to June 14, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-8-2026-to-june-14-2026/ Thu, 18 Jun 2026 18:38:41 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-8-2026-to-june-14-2026/ Last week, there were 102 vulnerabilities disclosed in 90 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 68 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 78
Unpatched 24

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 62
High Severity 36
Critical Severity 4

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 35
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 13
Exposure of Sensitive Information to an Unauthorized Actor 12
Cross-Site Request Forgery (CSRF) 8
Missing Authorization 8
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 5
Deserialization of Untrusted Data 4
Authorization Bypass Through User-Controlled Key 3
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
Incorrect Privilege Assignment 3
Improper Privilege Management 2
Server-Side Request Forgery (SSRF) 2
Access of Resource Using Incompatible Type (‘Type Confusion’) 1
Improper Verification of Cryptographic Signature 1
Incorrect Authorization 1
Unrestricted Upload of File with Dangerous Type 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

6

5

4

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
6Storage Rentals 6storage-rentals
ABC Crypto Checkout payerurl-crypto-currency-payment-gateway-for-woocommerce
Accordions accordions
Advanced 301 and 302 Redirect advanced-301-and-302-redirect
Affiliates Manager affiliates-manager
Ajax Load More – Infinite Scroll, Load More, & Lazy Load ajax-load-more
AJAX Report Comments report-comments
Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates animation-addons-for-elementor
aThemes Addons for Elementor athemes-addons-for-elementor-lite
Booking (Reservation & Appointment) directorist-booking
BookPro – Appointment Booking WordPress Plugin ovabookpro
Canvas canvas
CleanTalk Anti-Spam. Spam Firewall & Bot protection cleantalk-spam-protect
Conekta Payment Gateway conekta-payment-gateway
Coupon Affiliates – Affiliate Plugin for WooCommerce woo-coupon-usage
Custom Block Builder – Lazy Blocks lazy-blocks
Customer Support Ticket System & Helpdesk wp-ticket
Decent Comments decent-comments
Digital Signature Add-on for WooCommerce woocommerce-digital-signature
Doctreat Core doctreat_core
Easy Image Collage easy-image-collage
eCommerce Product Catalog Plugin for WordPress ecommerce-product-catalog
Email Encoder – Protect Email Addresses and Phone Numbers email-encoder-bundle
Enable Media Replace enable-media-replace
Events Calendar for GeoDirectory events-for-geodirectory
Extra Settings for RocketChat extra-settings-for-rocketchat
FastDup – Fastest WordPress Migration & Duplicator fastdup
FastPicker, an order picker and order management system (oms) for WooCommerce on steroids fastpicker
Faust.js faustwp
Fediverse Embeds fediverse-embeds
Feeds for YouTube (YouTube video, channel, and gallery plugin) feeds-for-youtube
Fortis for WooCommerce fortis-for-woocommerce
FV Flowplayer Video Player fv-wordpress-flowplayer
Global Body Mass Index Calculator global-body-mass-index-calculator
GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites gptranslate
Hash Elements hash-elements
Helpfulcrowd Product Reviews helpfulcrowd-product-reviews
Hippoo Mobile App for WooCommerce hippoo
JetBlog jet-blog
JetEngine jet-engine
jQuery Hover Footnotes jquery-hover-footnotes
kk blog card kk-blog-card
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more knit-pay
Listdom: AI-powered Business Directory with Classifieds Ads Listings listdom
LoginPress Pro loginpress-pro
LWS Optimize – All-in-One Speed Booster & Cache Tools lws-optimize
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails mailerpress
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system
Meow Gallery meow-gallery
MW WP Form mw-wp-form
Newsletters newsletters-lite
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
Open User Map PRO open-user-map-pro
Page Builder: Pagelayer – Drag and Drop website builder pagelayer
Payment forms, Buy now buttons, and Invoicing System | GetPaid invoicing
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel foogallery
Plugin Name: ePaperFlip Publisher epaperflip-publisher
Presto Player presto-player
Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages unlimited-elementor-inner-sections-by-boomdevs
Product Filter Widget for Elementor product-filter-widget-for-elementor
PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget pushengage
Recover Exit For WooCommerce recoverexit-for-woocommerce
RomanCart Ecommerce romancart-ecommerce
Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp
SEO Redirection Plugin – 301 Redirect Manager seo-redirection
Slider Revolution revslider
Store Locator WordPress agile-store-locator
Taskbuilder – Project Management & Task Management Tool With Kanban Board taskbuilder
The Events Calendar the-events-calendar
TinyMCE shortcode Addon 360crest-themeone-tinymce-shortcodes
UpdraftPlus Premium updraftplus
UpdraftPlus: WP Backup & Migration Plugin updraftplus
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration wp-user-frontend
VikRentCar Car Rental Management System vikrentcar
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce wc-multishipping
WooCommerce Anti-Fraud woocommerce-anti-fraud
WooCommerce Dropshipping Premium woocommerce-dropshipping
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. wp_scraper
WP ApplicantStack Jobs Display wp-applicantstack-jobs-display
WP Emoticon Rating wp-emoticon-rating
WP GDPR Cookie Consent wp-gdpr-cookie-consent
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters wp-google-map-plugin
WP Meta Sort Posts wp-meta-sort-posts
WP Migrate Lite – Migration Made Easy wp-migrate-db
WP Photo Album Plus wp-photo-album-plus
WP-Ultimate-Map wp-ultimate-map
WPC Product Options for WooCommerce wpc-product-options
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables
WpMobi wp-mobi
WPZOOM Portfolio Lite – Filterable Portfolio Plugin wpzoom-portfolio

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Blocksy blocksy
EventPress eventpress
Kastell – WordPress Theme for Single Properties and Apartments kastell
nifty nifty
XStore xstore

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Doctreat Core <= 1.6.8 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2025-6254
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

Doctreat Core [doctreat_core]

Researcher

More Details >

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-49063
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom]

Researcher

More Details >

LoginPress Pro <= 6.2.2 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-49058
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

LoginPress Pro [loginpress-pro]

Researcher

More Details >

WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2025-69129
Patch Status
Unpatched
Published
Jun 12, 2026

Affected Software

WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. [wp_scraper]

Researcher

More Details >

Blocksy <= 2.1.41 – Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via ‘blocksy_meta’ REST API Field

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-8365
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Blocksy [blocksy]

Researcher

More Details >

Events Calendar for GeoDirectory <= 2.3.28 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-11616
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Events Calendar for GeoDirectory [events-for-geodirectory]

Researcher

More Details >

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-49111
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

JetEngine <= 3.8.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-52706
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

Kastell <= 2.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-52707
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Kastell – WordPress Theme for Single Properties and Apartments [kastell]

Researcher

More Details >

Nifty <= 1.4.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-27429
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

nifty [nifty]

Researcher

More Details >

Recover Exit For WooCommerce <= 1.0.3 – Unauthenticated Local File Inclusion via ‘tpf’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-9662
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Recover Exit For WooCommerce [recoverexit-for-woocommerce]

Researcher

More Details >

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) – Unauthenticated Authentication Bypass via UpdraftCentral udrpc

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-10795
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

UpdraftPlus: WP Backup & Migration Plugin [updraftplus]
UpdraftPlus Premium [updraftplus]

Researcher

More Details >

6Storage Rentals <= 2.22.0 – Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via ‘userId’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9185
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

6Storage Rentals [6storage-rentals]

Researcher

More Details >

Advanced 301 and 302 Redirect <= 1.6.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49067
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Advanced 301 and 302 Redirect [advanced-301-and-302-redirect]

Researcher

More Details >

BookPro <= 1.1.0 – Unauthenticated Arbitrary File Deletion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-27400
Patch Status
Unpatched
Published
Jun 12, 2026

Affected Software

BookPro – Appointment Booking WordPress Plugin [ovabookpro]

Researcher

More Details >

Decent Comments < 3.0.2 – Unauthenticated Information Exopsure

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-7385
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Decent Comments [decent-comments]

Researcher

More Details >

eCommerce Product Catalog Plugin for WordPress <= 3.5.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-52693
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

eCommerce Product Catalog Plugin for WordPress [ecommerce-product-catalog]

Researcher

More Details >

JetEngine < 3.8.9.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49084
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetEngine <= 3.8.9.1 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49075
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetEngine <= 3.8.9.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49076
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

Newsletters <= 4.13 – Unauthenticated SQL Injection via wpmlsubscriber_id Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-3018
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

The Events Calendar 6.15.12-6.16.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49772
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researcher

More Details >

WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 – Unauthenticated Arbitrary File Download

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2025-69131
Patch Status
Unpatched
Published
Jun 12, 2026

Affected Software

WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. [wp_scraper]

Researcher

More Details >

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 – Authenticated (Subscriber+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-6381
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin]

Researcher

More Details >

WP Photo Album Plus < 9.1.11.001 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-6379
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WP Ticket <= 6.0.4 – Unauthenticated SQL Injection via WordPress Search ‘s’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9848
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Customer Support Ticket System & Helpdesk [wp-ticket]

Researcher

More Details >

WPC Product Options for WooCommerce <= 3.2.1 – Unauthenticated Arbitrary File Download

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49061
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

WPC Product Options for WooCommerce [wpc-product-options]

Researcher

More Details >

wpDataTables (Premium) <= 7.3.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49080
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables]

Researcher

More Details >

XStore < 9.7.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-3326
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

XStore [xstore]

Researcher

More Details >

Ajax Load More – Infinite Scroll, Load More, & Lazy Load < 7.8.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-6495
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Ajax Load More – Infinite Scroll, Load More, & Lazy Load [ajax-load-more]

Researcher

More Details >

CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-8071
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

CleanTalk Anti-Spam. Spam Firewall & Bot protection [cleantalk-spam-protect]

Researcher

More Details >

Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-5776
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Email Encoder – Protect Email Addresses and Phone Numbers [email-encoder-bundle]

Researcher

More Details >

Fediverse Embeds <= 1.5.7 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-46697
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Fediverse Embeds [fediverse-embeds]

Researcher

More Details >

Fediverse Embeds <= 1.5.7 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-46698
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Fediverse Embeds [fediverse-embeds]

Researcher

More Details >

FV Flowplayer Video Player <= 7.5.49.7212 – Unauthenticated Stored Cross-Site Scripting via Comment Text

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-7556
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

FV Flowplayer Video Player [fv-wordpress-flowplayer]

Researchers

More Details >

GPTranslate <= 2.31 – Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-9109
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites [gptranslate]

Researchers

More Details >

JetEngine <= 3.8.9.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-49074
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

Online Scheduling and Appointment Booking System – Bookly <= 27.2 – Unauthenticated Stored Cross-Site Scripting via ‘bookly-customer-full-name’ Cookie

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-5513
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

SEO Redirection Plugin – 301 Redirect Manager <= 9.17 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-52702
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

SEO Redirection Plugin – 301 Redirect Manager [seo-redirection]

Researcher

More Details >

WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.21 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-49069
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

WPZOOM Portfolio Lite – Filterable Portfolio Plugin [wpzoom-portfolio]

Researcher

More Details >

Booking (Reservation & Appointment) <= 3.0.3 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-49073
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Booking (Reservation & Appointment) [directorist-booking]

Researcher

More Details >

Slider Revolution 7.0 – 7.0.10 – Authenticated (Subscriber+) Sensitive Information Disclosure

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-7542
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Slider Revolution [revslider]

Researcher

More Details >

Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.7 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-52697
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

Taskbuilder – Project Management & Task Management Tool With Kanban Board [taskbuilder]

Researcher

More Details >

WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce <= 3.0.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-52700
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce [wc-multishipping]

Researcher

More Details >

Accordions <= 2.3.23 – Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10862
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Accordions [accordions]

Researcher

More Details >

Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-8444
Patch Status
Unpatched
Published
Jun 9, 2026

Affected Software

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates [animation-addons-for-elementor]

Researcher

More Details >

aThemes Addons for Elementor <= 1.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘title_tag’ Widget Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8613
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

aThemes Addons for Elementor [athemes-addons-for-elementor-lite]

Researcher

More Details >

Canvas <= 2.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘tag’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9629
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Canvas [canvas]

Researcher

More Details >

Easy Image Collage <= 1.13.6 – Authenticated (Author+) Stored Cross-Site Scripting via ‘grid[properties][borderColor]’ and ‘grid[images][N][attachment_url]’ Parameters

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9019
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

Easy Image Collage [easy-image-collage]

Researcher

More Details >

Enable Media Replace <= 4.1.8 – Authenticated (Author+) Stored Cross-Site Scripting via ‘location_dir’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5714
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Enable Media Replace [enable-media-replace]

Researcher

More Details >

ePaperFlip Publisher <= 1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘publicationid’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-7662
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Plugin Name: ePaperFlip Publisher [epaperflip-publisher]

Researcher

More Details >

Extra Settings for RocketChat <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8841
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Extra Settings for RocketChat [extra-settings-for-rocketchat]

Researcher

More Details >

Global Body Mass Index Calculator <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8883
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Global Body Mass Index Calculator [global-body-mass-index-calculator]

Researcher

More Details >

jQuery Hover Footnotes <= 1.4 – Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier (‘{{…}}’ Syntax)

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10738
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

jQuery Hover Footnotes [jquery-hover-footnotes]

Researcher

More Details >

kk blog card <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8895
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

kk blog card [kk-blog-card]

Researcher

More Details >

MailerPress <= 2.0.4 – Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8599
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails [mailerpress]

Researcher

More Details >

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-3297
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Page Builder: Pagelayer – Drag and Drop website builder [pagelayer]

Researchers

More Details >

Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘custom_attribute_key’ Shortcode Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9134
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel [foogallery]

Researcher

More Details >

Prime Elementor Addons <= 1.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8677
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages [unlimited-elementor-inner-sections-by-boomdevs]

Researcher

More Details >

RomanCart Ecommerce <= 2.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8880
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

RomanCart Ecommerce [romancart-ecommerce]

Researcher

More Details >

The Ultimate Video Player For WordPress <= 4.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘link_url’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9125
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Presto Player [presto-player]

Researcher

More Details >

TinyMCE shortcode Addon <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘btnrel’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10024
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

TinyMCE shortcode Addon [360crest-themeone-tinymce-shortcodes]

Researcher

More Details >

WP ApplicantStack Jobs Display <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8882
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP ApplicantStack Jobs Display [wp-applicantstack-jobs-display]

Researcher

More Details >

WP GDPR Cookie Consent <= 1.0.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘ninja_gdpr_ajax_actions’ AJAX Action

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8977
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP GDPR Cookie Consent [wp-gdpr-cookie-consent]

Researchers

More Details >

EventPress < 22.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-6268
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

EventPress [eventpress]

Researcher(s): Unknown

More Details >

Product Filter Widget for Elementor <= 1.0.6 – Reflected Cross-Site Scripting via ‘args[filterFormArray]’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-11603
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Product Filter Widget for Elementor [product-filter-widget-for-elementor]

Researcher

More Details >

WP Emoticon Rating <= 1.0.1 – Cross-Site Request Forgery to Reflected Cross-Site Scripting via ’emo_settings’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8910
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP Emoticon Rating [wp-emoticon-rating]

Researcher

More Details >

WP-Ultimate-Map <= 1.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting via ‘zoom-level’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8907
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP-Ultimate-Map [wp-ultimate-map]

Researcher

More Details >

ABC Crypto Checkout <= 1.8.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52695
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

ABC Crypto Checkout [payerurl-crypto-currency-payment-gateway-for-woocommerce]

Researcher

More Details >

Affiliates Manager <= 2.9.50 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52692
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Affiliates Manager [affiliates-manager]

Researcher

More Details >

Conekta Payment Gateway <= 6.0.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49066
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Conekta Payment Gateway [conekta-payment-gateway]

Researcher

More Details >

Digital Signature Add-on for WooCommerce <= 2.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52694
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

Digital Signature Add-on for WooCommerce [woocommerce-digital-signature]

Researcher

More Details >

FastDup – Fastest WordPress Migration & Duplicator <= 2.7.2 – Unauthenticated Path Traversal

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52703
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

FastDup – Fastest WordPress Migration & Duplicator [fastdup]

Researcher

More Details >

Fortis for WooCommerce < 1.3.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-15609
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Fortis for WooCommerce [fortis-for-woocommerce]

Researcher(s): Unknown

More Details >

Helpfulcrowd Product Reviews <= 1.2.9 – Inccorect Authorization via Type Juggling in ‘token’ Parameter to Arbitrary Settings Update

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8499
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Helpfulcrowd Product Reviews [helpfulcrowd-product-reviews]

Researcher

More Details >

Hippoo Mobile App for WooCommerce <= 1.9.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49065
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Hippoo Mobile App for WooCommerce [hippoo]

Researcher

More Details >

JetBlog <= 2.4.8 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52696
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

JetBlog [jet-blog]

Researcher

More Details >

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.4.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49070
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more [knit-pay]

Researcher

More Details >

Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.49 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49064
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Payment forms, Buy now buttons, and Invoicing System | GetPaid [invoicing]

Researcher

More Details >

Schema & Structured Data for WP & AMP < 1.60 – Unauthenticated Arbitrary Media Upload

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9067
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

VikRentCar Car Rental Management System <= 1.4.5 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52699
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

VikRentCar Car Rental Management System [vikrentcar]

Researcher

More Details >

WooCommerce Anti-Fraud <= 7.2.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49072
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

WooCommerce Anti-Fraud [woocommerce-anti-fraud]

Researcher

More Details >

WooCommerce Dropshipping Premium <= 5.2.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49071
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

WooCommerce Dropshipping Premium [woocommerce-dropshipping]

Researcher

More Details >

WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 – Authenticated (Editor+) Arbitrary File Read

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-12089
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

LWS Optimize – All-in-One Speed Booster & Cache Tools [lws-optimize]

Researcher

More Details >

Open User Map PRO <= 1.4.31 – Unauthenticated Stored Cross-Site Scripting via ‘oum_location_notification’

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-2827
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

Open User Map PRO [open-user-map-pro]

Researcher

More Details >

Custom Block Builder – Lazy Blocks < 4.3.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-8981
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Custom Block Builder – Lazy Blocks [lazy-blocks]

Researcher

More Details >

MW WP Form <= 5.1.3 – Authenticated (Editor+) Stored Cross-Site Scripting via ‘memo’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-8853
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

MW WP Form [mw-wp-form]

Researcher

More Details >

Store Locator WordPress < 1.6.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-9060
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Store Locator WordPress [agile-store-locator]

Researcher

More Details >

AJAX Report Comments <= 2.0.4 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8902
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

AJAX Report Comments [report-comments]

Researcher

More Details >

Coupon Affiliates – Affiliate Plugin for WooCommerce <= 7.8.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49068
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

Coupon Affiliates – Affiliate Plugin for WooCommerce [woo-coupon-usage]

Researcher

More Details >

FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 – Cross-Site Request Forgery via Settings Save

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8904
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

FastPicker, an order picker and order management system (oms) for WooCommerce on steroids [fastpicker]

Researcher

More Details >

Faust.js <= 1.8.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49062
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Faust.js [faustwp]

Researcher

More Details >

Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-1631
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Feeds for YouTube (YouTube video, channel, and gallery plugin) [feeds-for-youtube]

Researcher

More Details >

Hash Elements <= 1.5.4 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24618
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Hash Elements [hash-elements]

Researcher

More Details >

jQuery Hover Footnotes <= 1.4 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10553
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

jQuery Hover Footnotes [jquery-hover-footnotes]

Researcher

More Details >

Meow Gallery <= 5.4.4 – Missing Authorization to Authenticated (Author+) Shortcode creation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-1291
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Meow Gallery [meow-gallery]

Researcher

More Details >

Pagelayer <= 2.0.9 – Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via ‘contacts’

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-2470
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Page Builder: Pagelayer – Drag and Drop website builder [pagelayer]

Researcher

More Details >

PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget <= 4.2.3 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-52698
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget [pushengage]

Researcher

More Details >

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 – Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-4058
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration [wp-user-frontend]

Researcher

More Details >

WP Meta Sort Posts <= 0.9 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8940
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP Meta Sort Posts [wp-meta-sort-posts]

Researcher

More Details >

WP Migrate Lite – Migration Made Easy <= 2.7.8 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49043
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

WP Migrate Lite – Migration Made Easy [wp-migrate-db]

Researcher

More Details >

WpMobi <= 0.0.3 – Cross-Site Request Forgery via save_general_settings Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8909
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WpMobi [wp-mobi]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 8, 2026 to June 14, 2026) appeared first on Wordfence.

]]>